Incidents by attack type:
The fast-growing extortion group TheGentlemen added German naval-defense electronics manufacturer Atlas Elektronik to its dark-web leak site on 28 June 2026, claiming a double-extortion attack dated to around 25 June, though the TKMS subsidiary had not publicly confirmed any breach.
Indian automaker Bajaj Auto disclosed that a ransomware attack detected on the morning of 23 June 2026 affected systems at the company and its technology subsidiary, prompting containment measures and regulatory filings with CERT-In and SEBI.
The Qilin ransomware group publicly claimed a June cyberattack on the Central Bank of Libya, threatening to leak stolen data after the bank said the intrusion touched a limited number of systems.
Japanese motor and electronics giant Nidec confirmed a ransomware attack on its Taiwanese subsidiary Nidec Chaun Choung Technology, after which the Blackfield gang claimed the breach and demanded a $2 million ransom.
Michigan's largest federally qualified health center, Cherry Health, posted a preliminary breach notice on 18 June 2026 after suspicious network activity detected in April triggered a days-long outage and the copying of patient and staff data, including Social Security numbers.
On 22 May 2026, the town hall of Eyguiรจres (Bouches-du-Rhรดne, ~7,000 inhabitants) was hit by a Qilin ransomware attack that took down its municipal IT systems and put residents' administrative and personal data at risk of compromise.
The Titan ransomware group claimed a double-extortion attack on Groupe CRIT's Tunisian subsidiary CRIT Tunisie, leaking payroll and administrative records, financial files and scanned identity documents and passports belonging to workers and employees.
Transitions Pro Centre-Val de Loire, the regional body that funds and supports employee career-retraining projects, was hit by the Prinz Eugen ransomware group, which claimed to have exfiltrated and encrypted hundreds of gigabytes of HR, financial and personal data and threatened to publish it.
The Anubis ransomware group claims to have compromised the systems of A.R.Ge.Co, a French company specializing in accounting services and
The Nitrogen ransomware group claimed on its dark-web leak site that it had stolen over 11 million files from Foxconn's North American facilities, including confidential information belonging to customers Apple, Dell, Google, Intel, Nvidia, and Sony. Foxconn said affected factories were resuming normal production.
The Qilin ransomware group claims to have compromised the systems of Le Domaine des Tournels, an establishment located in the Gulf of Saint-Tropez. At this
In May 2026, the BravoX ransomware group claimed a double-extortion attack on Soprolux, a French food distributor serving restaurants and professional clients, publishing banking documents, SEPA mandates, IBAN/RIB details and customer and supplier records to pressure the company.
In early May 2026, the MedusaLocker ransomware gang listed the Acadรฉmie de Montpellier / CSJM โ a French public-school network around Bรฉziers โ on its leak site, claiming to have exfiltrated administrative documents and credentials, with reported exposure of 309 staff and 6,915 user accounts.
On 5 May 2026, the SpaceBears ransomware group listed French industrial-equipment manufacturer Erla Technologies SAS on its leak site, claiming to have stolen employee and client personal data, financial documents and project files โ including documentation tied to a French army client.
On 3 May 2026 the town of Quiberon (Morbihan, France) was hit by a Qilin ransomware attack that encrypted part of its IT systems and exfiltrated personal data; the city refused the ransom and began a gradual, secured rebuild of its infrastructure.
On 27 April 2026, the Qilin ransomware group listed Exclusive Networks โ the France-headquartered global cybersecurity and IT distributor โ on its leak site, threatening to publish stolen data unless the company entered negotiations; the scope remained unconfirmed.
In April 2026, the Coinbase Cartel extortion group listed French energy giant Engie on its dark web leak site, claiming to have stolen sensitive data and threatening to publish a full dump unless a ransom was paid; Engie did not publicly confirm the breach.
On 21 April 2026, French medical-packaging manufacturer Sterimed was claimed by the Qilin ransomware group, which published internal files โ technical documents, project data, HR records, IT-security material and system backups โ on its dark-web leak site.
On 20 April 2026, the City'Pro Marionneau vocational and driving-training network was hit by a cyberattack claimed by the Qilin ransomware group, which published stolen files โ trainee records, HR documents, and commercial data โ on its leak site.
On 20 April 2026, French law firm Gueguen Avocats was listed on the Qilin ransomware leak site, which claimed to have exfiltrated thousands of files including internal emails, financial reports, a password spreadsheet, employee data and client case files.
Filair, a French industrial metal-fabrication company, was hit by the Lamashtu extortion group, which exfiltrated and published nearly 50 years of internal archives โ tens of thousands of files spanning CAD engineering data, financial records and HR documents.
Gauthier Tissus, a French manufacturer of technical woven and finished fabrics, was listed on the Lamashtu extortion group's leak site, which published roughly 54 GB (about 8,500 files spanning 1996โ2026) of internal financial, HR, commercial and R&D data.
On 14 April 2026, the threat actor Lamashtu claimed to have stolen roughly 52.6 GB of data and about 41,000 files from France's wine appellations confederation CNAOC, spanning 1994-2025 and including financial, HR and governance records.
On 8 April 2026, the French metal-grating manufacturer Diamond was listed on the Gunra ransomware group's leak site, which claimed to have exfiltrated confidential OneDrive and SharePoint documents covering projects, clients and internal operations.
In early April 2026, Synergy, a French data-management and cloud-services provider, was reportedly hit by a ransomware attack involving unauthorised access to its systems and a probable threat to exfiltrated client data; the scale and attacker were not disclosed.
On 6 April 2026, the Akira ransomware group listed French aerospace connector manufacturer Gauthier Connectique (a Nicomatic company) on its leak site, threatening to publish 42 GB of exfiltrated data including employee ID documents, technical drawings, financial records and NDAs.
On 6 April 2026, Bordeaux-based healthcare software publisher YMED, which runs the SOONCAREยฎ appointment platform, was hit by an extortion attack claimed by the group XP95, which exfiltrated 132 GB of data covering 253,342 patients and over 431,000 medical files.
French cosmetics manufacturer Aircos Pascual, a subsidiary of the Anjac group, is targeted by a ransomware attack claimed by the group
Fountain, a Belgian stock-listed provider of workplace coffee and refreshment services, disclosed in early April 2026 a ransomware attack involving unauthorized access to part of its IT systems and confirmed data exfiltration, with the DragonForce group claiming responsibility.
French manufacturer Serap, the world's leading maker of farm milk cooling tanks, was hit by an Akira ransomware double-extortion attack disclosed on 2 April 2026, with the group threatening to publish around 50 GB of stolen internal data.
Under Armour confirmed a breach by the Everest ransomware group that exposed roughly 72.7 million unique customer email addresses along with names, dates of birth, genders, locations and purchase histories, leaked publicly after extortion failed and now reaching French customers.
On 1 April 2026, the French Catholic school group Notre-Dame du Grandchamp was listed on NightSpire's leak site after a ransomware attack that exfiltrated roughly 330 GB of data, including students' medical records, academic files and HR data on thousands of pupils and staff.
On 30 March 2026, the extortion group ALP-001 listed French telecom group Iliad (parent of Free) on its leak site, publishing a 5.4 GB sample of mobile-network engineering data โ radio measurements, GPS drive tests, and network optimization records โ and threatening fuller disclosure.
On 2 March 2026, ticketing platform Vivaticket disclosed a RansomHouse ransomware attack that exfiltrated customer data โ names, emails, postal codes and purchase history โ affecting users of 3,500 partner venues including the Louvre and the BnF.
In early March 2026, French aerospace and automotive fastener manufacturer LISI Group was hit by the Qilin ransomware gang, which exfiltrated a limited set of corporate data โ bank account/IBAN details, supply contracts, confidentiality agreements and employee information โ from two ancillary sites.
In early 2026, French digital-infrastructure consultancy Tactis was hit by the Qilin ransomware gang, which listed the firm on its leak site and threatened to publish exfiltrated internal data covering its telecom and smart-city projects for public and private clients.
In February 2026 the LAPSUS$ extortion group claimed the theft of about 420 GB of data from France's Civil Aviation Safety Organisation (OSAC), including ID cards, passports, diplomas, proof-of-address documents and internal files; the data was later leaked in full.
On 19 February 2026, the Incransom ransomware group claimed to have stolen 279 GB of data (225,372 files) from French environmental-remediation firm Valgo SA, including contracts, NDAs, financial records and client data naming Renault Group and others.
Permanent and non-permanent staff who worked at CNRS before 31 December 2006 are affected by a data leak confirmed by CNRS. The exact volume of exposed information has notโฆ
In early February 2026, the Qilin ransomware group listed French coach-travel operator Voyages Robin on its dark-web leak site, claiming to have stolen customer booking details, travel itineraries and financial records.
Delko, a French automotive repair and spare-parts franchise network, was hit by the Sinobi ransomware group around December 2025; the gang published the company on its leak site on 5 January 2026, with the claim relayed to affected customers and publicly on 20 January 2026.
In January 2026, sportswear brand Under Armour was hit by a data leak after the Everest ransomware gang published roughly 72.9 million stolen customer records online, including about 6.7 million people in France, exposing names, emails, dates of birth and purchase history.
The Akira ransomware group listed French roller-shutter component manufacturer Zurflรผh-Feller as a victim in early 2026, threatening to publish around 66 GB of stolen corporate data, including employee identity documents, financials, contracts and NDAs.
In late December 2025, the town hall of Lens (Pas-de-Calais, France) disclosed an intrusion into its information system that paralysed municipal services for about a week, blocking staff software and telephone lines; the attack vector was undisclosed and data theft was not confirmed.
In December 2025, the EHPAD Rรฉsidence du Parc nursing home in Champdeniers-Saint-Denis (Deux-Sรจvres, France), home to around 90 residents, was hit by a ransomware attack that encrypted files and dropped a $5 million ransom note; administrative data and possibly scanned ID documents were exposed.
A threat actor exfiltrated around 387 GB of data (some 411,000 files) from French mortgage and credit broker La Centrale de Financement, exposing highly sensitive customer KYC documents, financial records and internal files, then offered the dataset for sale after failed extortion negotiations.
In November 2025, the Cl0p extortion gang listed French tyre maker Michelin on its leak site, claiming to have stolen internal manufacturing, engineering, supply-chain, financial and HR files via the Oracle E-Business Suite zero-day (CVE-2025-61882).
On 27 October 2025, Italian sofa and furniture retailer Poltronesofร suffered a ransomware attack that encrypted its servers and exposed personal data of thousands of customers, including names, postal addresses, emails, phone numbers and tax identification numbers; no banking data was affected.
On 19 October 2025, the Centre Hospitalier Intercommunal de Haute-Comtรฉ in Pontarlier (France) was hit by a Cryptolocker ransomware attack that encrypted part of its data, forcing a full IT shutdown and a return to paper-based care; attackers demanded a 5 million euro ransom.
Ransomware group Qilin attacked the IT systems of public high schools run by France's Hauts-de-France region in October 2025, paralysing some 80% of around 269 schools and claiming over 1 TB of stolen data including students' ID documents, CVs and academic transcripts.
Qilin ransomware operators encrypted servers across Asahi's Japanese data centres, halting ordering, shipment, and production at 30 factories, leaking 27 GB of internal data, and exposing personal information of approximately 1.5 million customers, employees, and contacts.
A cyberattack on Britain's biggest carmaker forced JLR to shut down its global IT network and halted vehicle production in the UK, China, Slovakia, India, and Brazil for five weeks โ now considered the most economically damaging cyber incident in UK history.
On 28 July 2025, French web host FranceLink was hit by the Akira ransomware group, which encrypted about 93% of its servers and threatened to leak roughly 20GB of exfiltrated customer data.
On 13 August 2025, Partner Immo, a French provider of online property- and condominium-management software, was reported as the target of a ransomware/data-leak incident; the exact scope and exposed data were not publicly confirmed.
On 25 July 2025, French telecom group Orange detected unauthorized access to one of its information systems; the Warlock ransomware group later claimed the attack and published about 4 GB of data, which Orange described as outdated or low-sensitivity.
The DragonForce ransomware group claimed a July 2025 attack on French dry-cleaning chain 5ร Sec, exfiltrating roughly 290 GB of data โ SQL production and test databases spanning the group's France, Switzerland, Luxembourg, Spain and Portugal operations โ and published it after the company declined to pay.
In June 2025, the Anubis ransomware gang claimed a 64GB leak of ~39,000 confidential files from Disneyland Paris โ engineering plans and behind-the-scenes photos/videos of park attractions โ said to be stolen via a compromised third-party contractor.
CNPC USA was named on the Rhysida ransomware data-leak (extortion) site on 2025-06-16.
Jasper Products was named on the Play ransomware data-leak (extortion) site on 2025-06-16.
NF Stroth & Associates was named on the Play ransomware data-leak (extortion) site on 2025-06-16.
TBN Israel Hacked was named on the Handala ransomware data-leak (extortion) site on 2025-06-16.
Israelโs fuel supply system Data was named on the Handala ransomware data-leak (extortion) site on 2025-06-15.
S&H Express was named on the Play ransomware data-leak (extortion) site on 2025-06-15.
099 ISP Hacked was named on the Handala ransomware data-leak (extortion) site on 2025-06-14.
Aerodreams Hacked was named on the Handala ransomware data-leak (extortion) site on 2025-06-14.
Israel’s fuel supply system Hacked was named on the Handala ransomware data-leak (extortion) site on 2025-06-14.
Israelโs fuel supply system Hacked was named on the Handala ransomware data-leak (extortion) site on 2025-06-14.
NPD Products was named on the Play ransomware data-leak (extortion) site on 2025-06-14.
Project Partners was named on the Play ransomware data-leak (extortion) site on 2025-06-14.
Rollex was named on the Play ransomware data-leak (extortion) site on 2025-06-14.
Y.G. New Idan Hacked was named on the Handala ransomware data-leak (extortion) site on 2025-06-14.
Ajmanre.gov.ae was named on the Flocker ransomware data-leak (extortion) site on 2025-06-12.
alleray-labrouste was named on the Incransom ransomware data-leak (extortion) site on 2025-06-12.
AP Lettering was named on the Spacebears ransomware data-leak (extortion) site on 2025-06-11.
Mount Rogers Community Services was named on the Incransom ransomware data-leak (extortion) site on 2025-06-10.
Community Choice Credit Union was named on the Play ransomware data-leak (extortion) site on 2025-06-09.
EUC Sjlland was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-06-09.
Homestead Gardens was named on the Play ransomware data-leak (extortion) site on 2025-06-09.
Hudson River Housing was named on the Rhysida ransomware data-leak (extortion) site on 2025-06-07.
waiwhetu-medical-centre was named on the Incransom ransomware data-leak (extortion) site on 2025-06-07.
Kittery Police Department was named on the Incransom ransomware data-leak (extortion) site on 2025-06-06.
MTTEXPERTISES.COM was named on the Incransom ransomware data-leak (extortion) site on 2025-06-06.
Nunez Dental was named on the Incransom ransomware data-leak (extortion) site on 2025-06-06.
A*****e.gov.ae was named on the Flocker ransomware data-leak (extortion) site on 2025-06-05.
Ebac was named on the Play ransomware data-leak (extortion) site on 2025-06-05.
iscamen was named on the Incransom ransomware data-leak (extortion) site on 2025-06-05.
Lts.com.vn was named on the Flocker ransomware data-leak (extortion) site on 2025-06-05.
Triumph Construction was named on the Play ransomware data-leak (extortion) site on 2025-06-05.
cemeteries.local was named on the Incransom ransomware data-leak (extortion) site on 2025-06-04.
Funktel GmbH was named on the Incransom ransomware data-leak (extortion) site on 2025-06-04.
https://devimco.com/ was named on the Metaencryptor ransomware data-leak (extortion) site on 2025-06-04.
FLOE Internationa was named on the Play ransomware data-leak (extortion) site on 2025-06-03.
Jericho Fire Department was named on the Kairos ransomware data-leak (extortion) site on 2025-06-03.
Rochon was named on the Play ransomware data-leak (extortion) site on 2025-06-03.
Sandhills Medical Foundation was named on the Incransom ransomware data-leak (extortion) site on 2025-06-03.
Sorter Construction was named on the Play ransomware data-leak (extortion) site on 2025-06-03.
Capital Trade was named on the Play ransomware data-leak (extortion) site on 2025-06-02.
http://www.kcac.com was named on the BlackSuit ransomware data-leak (extortion) site on 2025-06-02.
Universidad Tรฉcnica del Norte Ecuador was named on the Incransom ransomware data-leak (extortion) site on 2025-06-02.
valuestoreit was named on the Incransom ransomware data-leak (extortion) site on 2025-06-02.
Vinda Group was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-06-02.
Dcsdev.org was named on the Flocker ransomware data-leak (extortion) site on 2025-06-01.
sitro.com.au was named on the Incransom ransomware data-leak (extortion) site on 2025-05-31.
Trustgrp.ae was named on the Flocker ransomware data-leak (extortion) site on 2025-05-31.
Acorn Sales was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-05-30.
Anchor Industries was named on the Play ransomware data-leak (extortion) site on 2025-05-30.
geruestba was named on the LockBit ransomware data-leak (extortion) site on 2025-05-30.
Jordan Drug was named on the Incransom ransomware data-leak (extortion) site on 2025-05-30.
M&H Electric Fabricators was named on the Embargo ransomware data-leak (extortion) site on 2025-05-30.
mysfa.org was named on the Incransom ransomware data-leak (extortion) site on 2025-05-30.
STANDBYTE was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-05-30.
Tri-Point Solutions was named on the Play ransomware data-leak (extortion) site on 2025-05-30.
UnigazJordan was named on the Ransomblog_noname ransomware data-leak (extortion) site on 2025-05-30.
W.E. Bowers was named on the Play ransomware data-leak (extortion) site on 2025-05-30.
http://metromont.com was named on the BlackSuit ransomware data-leak (extortion) site on 2025-05-29.
http://www.innsofaurora.com was named on the BlackSuit ransomware data-leak (extortion) site on 2025-05-29.
Mulia Raya was named on the Ransomblog_noname ransomware data-leak (extortion) site on 2025-05-29.
Cator Ruma & Associates was named on the Rhysida ransomware data-leak (extortion) site on 2025-05-28.
Eliel Cycling was named on the Play ransomware data-leak (extortion) site on 2025-05-28.
Fujipoly Ltd was named on the Spacebears ransomware data-leak (extortion) site on 2025-05-28.
KDV Label was named on the Play ransomware data-leak (extortion) site on 2025-05-28.
l*s.com.vn was named on the Flocker ransomware data-leak (extortion) site on 2025-05-28.
Corantioquia was named on the Hunters International ransomware data-leak (extortion) site on 2025-05-27.
Eight8Ate Holdings, Inc was named on the Hunters International ransomware data-leak (extortion) site on 2025-05-27.
http://www.iptelecom.at was named on the Ciphbit ransomware data-leak (extortion) site on 2025-05-27.
WAT Supplies was named on the Play ransomware data-leak (extortion) site on 2025-05-27.
Wrap & Send Services was named on the Hunters International ransomware data-leak (extortion) site on 2025-05-27.
allstarflooring.com was named on the Embargo ransomware data-leak (extortion) site on 2025-05-26.
Antea Luce was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-05-26.
Carrera Chevrolet was named on the Rhysida ransomware data-leak (extortion) site on 2025-05-26.
Frederick's Machine & Tool Shop was named on the Play ransomware data-leak (extortion) site on 2025-05-26.
Media Links was named on the Play ransomware data-leak (extortion) site on 2025-05-26.
D****v.org was named on the Flocker ransomware data-leak (extortion) site on 2025-05-25.
oxparkrec.org was named on the Incransom ransomware data-leak (extortion) site on 2025-05-25.
Seneca Gaming & Entertainment was named on the Nitrogen ransomware data-leak (extortion) site on 2025-05-25.
Coweta County School System was named on the Nitrogen ransomware data-leak (extortion) site on 2025-05-24.
T******p.ae was named on the Flocker ransomware data-leak (extortion) site on 2025-05-24.
Vernon Milling was named on the Play ransomware data-leak (extortion) site on 2025-05-24.
AKJ Energiteknik was named on the Play ransomware data-leak (extortion) site on 2025-05-23.
South Atlantic Federal Credit Union was named on the Play ransomware data-leak (extortion) site on 2025-05-23.
4Motive was named on the Spacebears ransomware data-leak (extortion) site on 2025-05-22.
CNHI LLC was named on the Play ransomware data-leak (extortion) site on 2025-05-22.
Curewell Pharmacy & Surgicals was named on the Spacebears ransomware data-leak (extortion) site on 2025-05-22.
Greater Seattle Concrete was named on the Play ransomware data-leak (extortion) site on 2025-05-22.
piercecountylibrary.org was named on the Incransom ransomware data-leak (extortion) site on 2025-05-22.
AttainX was named on the Play ransomware data-leak (extortion) site on 2025-05-21.
Neighborhood Development Services was named on the Kairos ransomware data-leak (extortion) site on 2025-05-21.
Rivers Academy West London was named on the Incransom ransomware data-leak (extortion) site on 2025-05-21.
Durham Arts Council was named on the Kairos ransomware data-leak (extortion) site on 2025-05-20.
Florida Lung was named on the Rhysida ransomware data-leak (extortion) site on 2025-05-20.
Runtec was named on the Lynx ransomware data-leak (extortion) site on 2025-05-20.
The Vascular Experts was named on the Incransom ransomware data-leak (extortion) site on 2025-05-20.
Tri State Electric was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-05-20.
K & K Fence was named on the Play ransomware data-leak (extortion) site on 2025-05-19.
Colegio de la Compania de Maria Vigo was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-05-18.
Fong Shann Printing Philippines was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-05-18.
Grupo Boulevard was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-05-18.
null was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-18.
RECI SYSTEMS was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-05-18.
Road Development Corporation was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-05-18.
Termolar was named on the Rhysida ransomware data-leak (extortion) site on 2025-05-18.
diyar.com was named on the Lynx ransomware data-leak (extortion) site on 2025-05-17.
Gearhiser Peters Elliott & Cannon was named on the Lynx ransomware data-leak (extortion) site on 2025-05-17.
Maruichi Leavitt Pipe & Tube was named on the Lynx ransomware data-leak (extortion) site on 2025-05-17.
nissi-beach.com was named on the Incransom ransomware data-leak (extortion) site on 2025-05-17.
npfy.org was named on the Incransom ransomware data-leak (extortion) site on 2025-05-17.
ros.eu was named on the Incransom ransomware data-leak (extortion) site on 2025-05-17.
www.davisdavisco.com was named on the Incransom ransomware data-leak (extortion) site on 2025-05-17.
alpha-steuer.de was named on the Incransom ransomware data-leak (extortion) site on 2025-05-16.
Carney Badley Spellman was named on the Play ransomware data-leak (extortion) site on 2025-05-16.
ccrcda.org was named on the Incransom ransomware data-leak (extortion) site on 2025-05-16.
finanzconsult-immobilien.de was named on the Incransom ransomware data-leak (extortion) site on 2025-05-16.
south african airways (flysaa.com) was named on the Incransom ransomware data-leak (extortion) site on 2025-05-16.
Triple Jump was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-05-16.
[DISCLOSED]OeTTINGER Brauerei was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-05-15.
GARDNER ORTHOPEDICS was named on the Incransom ransomware data-leak (extortion) site on 2025-05-15.
http://www.gloucesterva.gov was named on the BlackSuit ransomware data-leak (extortion) site on 2025-05-15.
Grafton Technologies was named on the Play ransomware data-leak (extortion) site on 2025-05-14.
Kingsmen Creatives Ltd. was named on the Embargo ransomware data-leak (extortion) site on 2025-05-14.
Redirecting... was named on the Hellcat ransomware data-leak (extortion) site on 2025-05-14.
Regal Ideas was named on the Play ransomware data-leak (extortion) site on 2025-05-14.
Royal Chemical was named on the Lynx ransomware data-leak (extortion) site on 2025-05-14.
Sao Camilo Cachoeiro de Itapemirim was named on the Rhysida ransomware data-leak (extortion) site on 2025-05-14.
architekturbuero-heller.de was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-13.
Dishaka was named on the Play ransomware data-leak (extortion) site on 2025-05-13.
First Choice Courier & Messenger was named on the Spacebears ransomware data-leak (extortion) site on 2025-05-13.
Looper Goodwine was named on the Kairos ransomware data-leak (extortion) site on 2025-05-13.
Nedved Architekti was named on the Spacebears ransomware data-leak (extortion) site on 2025-05-13.
Operative was named on the Play ransomware data-leak (extortion) site on 2025-05-13.
Overhead Door of Nova Scotia was named on the Play ransomware data-leak (extortion) site on 2025-05-13.
thaonlesvosges.fr was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-13.
www.colemanmaterials.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-13.
altara.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-12.
atlplasticsurgeon.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-12.
EIZO Rugged Solutions was named on the Play ransomware data-leak (extortion) site on 2025-05-12.
iacc.holdings was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-12.
industrialdynamics.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-12.
jtalleycorp.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-12.
Just Concrete & Masonry was named on the Play ransomware data-leak (extortion) site on 2025-05-12.
net-move.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-12.
southernavionics.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-12.
www.condista.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-12.
www.dermatologysolutions.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-12.
www.philsmithauto.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-12.
dac-law.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-11.
kraftkisarna.se was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-11.
millercaggiano.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-11.
ossman.co.uk was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-11.
pratthomes.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-11.
pryor-morrow.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-11.
stitaly.it was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-11.
www.harrissteelco.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-11.
www.irisid.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-11.
www.precisiontextiles-usa.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-11.
www.setpointsystems.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-11.
www.texlaenergy.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-11.
American Eagle Logistics - Full Leak was named on the Monti ransomware data-leak (extortion) site on 2025-05-10.
citrusmagic.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-10.
statesmanbiz.com was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-10.
Verrex was named on the Play ransomware data-leak (extortion) site on 2025-05-10.
www.cityofgroveok.gov was named on the Dragonforce ransomware data-leak (extortion) site on 2025-05-10.
EMX Enterprises was named on the Play ransomware data-leak (extortion) site on 2025-05-09.
Gistic Research was named on the Play ransomware data-leak (extortion) site on 2025-05-09.
hennessyfunds.com was named on the LockBit ransomware data-leak (extortion) site on 2025-05-09.
Mountain View Mushrooms was named on the Rhysida ransomware data-leak (extortion) site on 2025-05-09.
Sweet Shop USA was named on the Play ransomware data-leak (extortion) site on 2025-05-09.
UniTrak was named on the Play ransomware data-leak (extortion) site on 2025-05-08.
vzlom7may.omg was named on the LockBit ransomware data-leak (extortion) site on 2025-05-08.
Amtech Software was named on the Monti ransomware data-leak (extortion) site on 2025-05-07.
GPF Lewis was named on the Hunters International ransomware data-leak (extortion) site on 2025-05-07.
LGM was named on the Termite ransomware data-leak (extortion) site on 2025-05-07.
Sioux Chief was named on the Hunters International ransomware data-leak (extortion) site on 2025-05-07.
Transport Lutztulln was named on the Orca ransomware data-leak (extortion) site on 2025-05-07.
Breen Construction Services was named on the Play ransomware data-leak (extortion) site on 2025-05-06.
Commune de Jemeppe-sur-Sambre was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-05-06.
Downtown Travel was named on the Play ransomware data-leak (extortion) site on 2025-05-06.
ehlers-inc.com was named on the LockBit ransomware data-leak (extortion) site on 2025-05-06.
Marine Technical Surveyors was named on the Play ransomware data-leak (extortion) site on 2025-05-06.
Mediprobe Research was named on the Rhysida ransomware data-leak (extortion) site on 2025-05-06.
Novosit was named on the Play ransomware data-leak (extortion) site on 2025-05-06.
Rand Technology was named on the Play ransomware data-leak (extortion) site on 2025-05-06.
Sugar Lake Lodge was named on the Play ransomware data-leak (extortion) site on 2025-05-06.
Technical Die-Casting was named on the Play ransomware data-leak (extortion) site on 2025-05-06.
Trybus was named on the Play ransomware data-leak (extortion) site on 2025-05-06.
Webcor was named on the Play ransomware data-leak (extortion) site on 2025-05-06.
Alberta Construction Safety Association was named on the Play ransomware data-leak (extortion) site on 2025-05-05.
ATI Systems was named on the Play ransomware data-leak (extortion) site on 2025-05-05.
Hire Velocity (lan.hirevelocity.com) was named on the Lynx ransomware data-leak (extortion) site on 2025-05-05.
OeTTINGER Brauerei was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-05-05.
pbw- was named on the LockBit ransomware data-leak (extortion) site on 2025-05-05.
CabinC.com was named on the Lynx ransomware data-leak (extortion) site on 2025-05-04.
soundtransit.org was named on the Braincipher ransomware data-leak (extortion) site on 2025-05-04.
valedolobo.com was named on the Braincipher ransomware data-leak (extortion) site on 2025-05-04.
American Eagle Logistics - Press Release was named on the Monti ransomware data-leak (extortion) site on 2025-05-03.
ddecor.com was named on the Braincipher ransomware data-leak (extortion) site on 2025-05-03.
edisoft.es was named on the Braincipher ransomware data-leak (extortion) site on 2025-05-03.
iycsa.com.co was named on the Braincipher ransomware data-leak (extortion) site on 2025-05-03.
Kalin Hobeltechnik was named on the Rhysida ransomware data-leak (extortion) site on 2025-05-03.
ruizre.es was named on the Braincipher ransomware data-leak (extortion) site on 2025-05-03.
arc-com.com was named on the LockBit ransomware data-leak (extortion) site on 2025-05-02.
derichsukonertz.de was named on the Lynx ransomware data-leak (extortion) site on 2025-05-02.
[DISCLOSED]Imedexsa was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-05-02.
ECOM America was named on the Play ransomware data-leak (extortion) site on 2025-05-02.
Government of Peru was named on the Rhysida ransomware data-leak (extortion) site on 2025-05-02.
kll-law.com was named on the LockBit ransomware data-leak (extortion) site on 2025-05-02.
pdcm.com was named on the LockBit ransomware data-leak (extortion) site on 2025-05-02.
runtec.co.jp was named on the Lynx ransomware data-leak (extortion) site on 2025-05-02.
Southern Fidelity was named on the Play ransomware data-leak (extortion) site on 2025-05-02.
The Seydel Companies was named on the Play ransomware data-leak (extortion) site on 2025-05-02.
Custom Paper was named on the Play ransomware data-leak (extortion) site on 2025-05-01.
Defected Records was named on the Play ransomware data-leak (extortion) site on 2025-05-01.
maywdef was named on the Lynx ransomware data-leak (extortion) site on 2025-05-01.
StudioVaiani was named on the Incransom ransomware data-leak (extortion) site on 2025-05-01.
The Saint James Hospital Group was named on the Incransom ransomware data-leak (extortion) site on 2025-05-01.
WDEF-TV was named on the Lynx ransomware data-leak (extortion) site on 2025-05-01.
Coop UQAM was named on the Rhysida ransomware data-leak (extortion) site on 2025-04-30.
Digestive Specialists was named on the Hunters International ransomware data-leak (extortion) site on 2025-04-30.
FCC was named on the Hunters International ransomware data-leak (extortion) site on 2025-04-30.
Gorham Sand & Gravel was named on the Play ransomware data-leak (extortion) site on 2025-04-30.
Missouri Pipe Fittings was named on the Play ransomware data-leak (extortion) site on 2025-04-30.
National Steel City was named on the Play ransomware data-leak (extortion) site on 2025-04-30.
Penn Emblem (penn.local) was named on the Lynx ransomware data-leak (extortion) site on 2025-04-30.
PermaCold Engineering was named on the Play ransomware data-leak (extortion) site on 2025-04-30.
southernagllc.com was named on the Lynx ransomware data-leak (extortion) site on 2025-04-30.
Telco Intercontinental was named on the Hunters International ransomware data-leak (extortion) site on 2025-04-30.
Ushio was named on the Termite ransomware data-leak (extortion) site on 2025-04-30.
BOLL Logistik was named on the Play ransomware data-leak (extortion) site on 2025-04-29.
Cooper Global Chauffeured was named on the Play ransomware data-leak (extortion) site on 2025-04-29.
David Mills CPA, LLC was named on the Lynx ransomware data-leak (extortion) site on 2025-04-29.
Haas & Associates was named on the Play ransomware data-leak (extortion) site on 2025-04-28.
Hpital Glengarry Memorial Hospital (clglen.local) was named on the Incransom ransomware data-leak (extortion) site on 2025-04-28.
LaBella Associates was named on the Rhysida ransomware data-leak (extortion) site on 2025-04-28.
Mantel Machine Products was named on the Play ransomware data-leak (extortion) site on 2025-04-28.
Minnesota Lawyers Mutual Insurance was named on the Hunters International ransomware data-leak (extortion) site on 2025-04-28.
Scientel Solutions was named on the Play ransomware data-leak (extortion) site on 2025-04-28.
Crawford Door Sales was named on the Play ransomware data-leak (extortion) site on 2025-04-27.
FMT Consultants was named on the Play ransomware data-leak (extortion) site on 2025-04-27.
Global Media Group was named on the Nitrogen ransomware data-leak (extortion) site on 2025-04-26.
M'AR De AR Hotels was named on the Nitrogen ransomware data-leak (extortion) site on 2025-04-26.
MDB was named on the Rhysida ransomware data-leak (extortion) site on 2025-04-26.
Stadtwerke Schwerte GmbH was named on the Nitrogen ransomware data-leak (extortion) site on 2025-04-26.
AKTO was named on the Nitrogen ransomware data-leak (extortion) site on 2025-04-25.
corporateflight.com was named on the Lynx ransomware data-leak (extortion) site on 2025-04-25.
friscochamber.com was named on the Lynx ransomware data-leak (extortion) site on 2025-04-25.
greatplainstransport.com was named on the Lynx ransomware data-leak (extortion) site on 2025-04-25.
impactcanada.com was named on the Lynx ransomware data-leak (extortion) site on 2025-04-25.
Kasb Bank - K-Trade was named on the Hunters International ransomware data-leak (extortion) site on 2025-04-25.
Kenworth Del Sur was named on the Hunters International ransomware data-leak (extortion) site on 2025-04-25.
pay4freight.com was named on the Lynx ransomware data-leak (extortion) site on 2025-04-25.
shgcpa.com was named on the Lynx ransomware data-leak (extortion) site on 2025-04-25.
arkansasprimarycare.com was named on the Incransom ransomware data-leak (extortion) site on 2025-04-24.
buildingmaterialspecialties.com was named on the Lynx ransomware data-leak (extortion) site on 2025-04-24.
Colorado Pulmonary Intensivists was named on the Kairos ransomware data-leak (extortion) site on 2025-04-24.
end2endtechnologies was named on the Lynx ransomware data-leak (extortion) site on 2025-04-24.
https://fortunesociety.org/ was named on the BlackSuit ransomware data-leak (extortion) site on 2025-04-24.
https://www.pacmet.com was named on the BlackSuit ransomware data-leak (extortion) site on 2025-04-24.
Vicarage Court Solicitors was named on the Lynx ransomware data-leak (extortion) site on 2025-04-24.
amethystgroup.co.uk was named on the Lynx ransomware data-leak (extortion) site on 2025-04-23.
Farmo Res was named on the Lynx ransomware data-leak (extortion) site on 2025-04-23.
iaconnect was named on the LockBit ransomware data-leak (extortion) site on 2025-04-23.
Lantronix was named on the Play ransomware data-leak (extortion) site on 2025-04-23.
lemi-group was named on the Incransom ransomware data-leak (extortion) site on 2025-04-23.
Mafi was named on the Hunters International ransomware data-leak (extortion) site on 2025-04-23.
Milicic was named on the Rhysida ransomware data-leak (extortion) site on 2025-04-23.
NESCTC was named on the Play ransomware data-leak (extortion) site on 2025-04-23.
Springer & Steinberg was named on the Lynx ransomware data-leak (extortion) site on 2025-04-23.
Suburban Carting was named on the Play ransomware data-leak (extortion) site on 2025-04-23.
The Derby High School was named on the Kairos ransomware data-leak (extortion) site on 2025-04-23.
The Human Bean was named on the Play ransomware data-leak (extortion) site on 2025-04-23.
Acos Favorit was named on the Rhysida ransomware data-leak (extortion) site on 2025-04-22.
All Book Covers was named on the Play ransomware data-leak (extortion) site on 2025-04-22.
Bacton Transport Services was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-04-22.
franklin nursing home was named on the Incransom ransomware data-leak (extortion) site on 2025-04-22.
Independent Financial Services was named on the Play ransomware data-leak (extortion) site on 2025-04-22.
Jet Ice was named on the Play ransomware data-leak (extortion) site on 2025-04-22.
R&N Manufacturing was named on the Lynx ransomware data-leak (extortion) site on 2025-04-22.
C-Mec was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-04-21.
Social-engineering of a third-party service desk gave Scattered Spider a domain administrator, which they used to deploy DragonForce ransomware on M&S's VMware ESXi estate at Easter 2025 โ knocking out contactless payments, Click & Collect, and online ordering for over six weeks.
Pharma Force was named on the Hunters International ransomware data-leak (extortion) site on 2025-04-21.
tuttoperlufficio.eu was named on the LockBit ransomware data-leak (extortion) site on 2025-04-21.
Z****a.com was named on the Flocker ransomware data-leak (extortion) site on 2025-04-19.
dhsmithco.com was named on the Lynx ransomware data-leak (extortion) site on 2025-04-18.
[EVIDENCE PACK 2] Telecontrol was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-04-18.
The Tech Interactive was named on the Moneymessage ransomware data-leak (extortion) site on 2025-04-18.
d-line was named on the Kairos ransomware data-leak (extortion) site on 2025-04-17.
EVERTECH INSTRUMENTAL CO., LTD was named on the Spacebears ransomware data-leak (extortion) site on 2025-04-17.
Feldman & Lopez was named on the Lynx ransomware data-leak (extortion) site on 2025-04-17.
HOPI was named on the Hunters International ransomware data-leak (extortion) site on 2025-04-17.
Hyalogic was named on the Lynx ransomware data-leak (extortion) site on 2025-04-17.
Koninklijke Ahold Delhaize N.V. was named on the Incransom ransomware data-leak (extortion) site on 2025-04-17.
Red Chamber was named on the Play ransomware data-leak (extortion) site on 2025-04-17.
Sally B Gold was named on the Lynx ransomware data-leak (extortion) site on 2025-04-17.
VIรUELAS ABOGADOS was named on the Spacebears ransomware data-leak (extortion) site on 2025-04-17.
aeamg.org.br was named on the LockBit ransomware data-leak (extortion) site on 2025-04-16.
aqhch.com.cn was named on the LockBit ransomware data-leak (extortion) site on 2025-04-16.
ende.bo was named on the LockBit ransomware data-leak (extortion) site on 2025-04-16.
iblinfo.de was named on the Incransom ransomware data-leak (extortion) site on 2025-04-16.
jackpotjunction.com was named on the LockBit ransomware data-leak (extortion) site on 2025-04-16.
McElwee Firm was named on the Lynx ransomware data-leak (extortion) site on 2025-04-16.
semex.com was named on the Underground ransomware data-leak (extortion) site on 2025-04-16.
spscompanies.com was named on the Lynx ransomware data-leak (extortion) site on 2025-04-16.
toolsign.com was named on the Lynx ransomware data-leak (extortion) site on 2025-04-16.
Astra Products was named on the Lynx ransomware data-leak (extortion) site on 2025-04-15.
Destination Toronto was named on the Play ransomware data-leak (extortion) site on 2025-04-15.
James & Sons Fine Jewelers was named on the Play ransomware data-leak (extortion) site on 2025-04-15.
Lake HVAC was named on the Lynx ransomware data-leak (extortion) site on 2025-04-15.
Merri-Makers was named on the Play ransomware data-leak (extortion) site on 2025-04-15.
Miller Boskus Lack Architects was named on the Play ransomware data-leak (extortion) site on 2025-04-15.
nevadareadymix.com was named on the Lynx ransomware data-leak (extortion) site on 2025-04-15.
O'Brien & Ryan was named on the Play ransomware data-leak (extortion) site on 2025-04-15.
Oregon Department of Environmental Quality was named on the Rhysida ransomware data-leak (extortion) site on 2025-04-15.
trocaire.edu was named on the Incransom ransomware data-leak (extortion) site on 2025-04-15.
Voigt-Abernathy Company was named on the Play ransomware data-leak (extortion) site on 2025-04-15.
Waller was named on the Play ransomware data-leak (extortion) site on 2025-04-15.
Calmont Group was named on the Play ransomware data-leak (extortion) site on 2025-04-14.
Comport Technology Solutions was named on the Play ransomware data-leak (extortion) site on 2025-04-14.
Cortez Resources was named on the Play ransomware data-leak (extortion) site on 2025-04-14.
MENTAL HEALTH was named on the Incransom ransomware data-leak (extortion) site on 2025-04-14.
Orthopaedic Specialists of Connecticut was named on the Incransom ransomware data-leak (extortion) site on 2025-04-14.
intelliloan.com was named on the LockBit ransomware data-leak (extortion) site on 2025-04-13.
acimfunds.com was named on the LockBit ransomware data-leak (extortion) site on 2025-04-12.
bilbie.com.au was named on the Lynx ransomware data-leak (extortion) site on 2025-04-12.
Bjรธrklund was named on the Termite ransomware data-leak (extortion) site on 2025-04-12.
Chickenshed was named on the Incransom ransomware data-leak (extortion) site on 2025-04-12.
Dimension Composite was named on the Rhysida ransomware data-leak (extortion) site on 2025-04-12.
On IT was named on the Termite ransomware data-leak (extortion) site on 2025-04-12.
Restaurant Associates was named on the Lynx ransomware data-leak (extortion) site on 2025-04-12.
visionproducts.llc was named on the LockBit ransomware data-leak (extortion) site on 2025-04-12.
C?l???t Group was named on the Play ransomware data-leak (extortion) site on 2025-04-11.
Codinter was named on the Play ransomware data-leak (extortion) site on 2025-04-11.
Colmar Industrial Supplies was named on the Lynx ransomware data-leak (extortion) site on 2025-04-11.
Harvest, a French wealth-management software editor, was hit by a Run Some Wares ransomware double-extortion attack disclosed in April 2025; internal and client files were exfiltrated and published, reportedly exposing data on tens of thousands of individuals and thousands of companies.
hotelemc2.c was named on the LockBit ransomware data-leak (extortion) site on 2025-04-11.
Imagineering Finishing Technologies was named on the Incransom ransomware data-leak (extortion) site on 2025-04-11.
KER Custom Molders was named on the Play ransomware data-leak (extortion) site on 2025-04-11.
mbmdubai.com was named on the Braincipher ransomware data-leak (extortion) site on 2025-04-11.
New York Sports Club was named on the Play ransomware data-leak (extortion) site on 2025-04-11.
Noyen Construction was named on the Play ransomware data-leak (extortion) site on 2025-04-11.
PAC Strapping Products was named on the Play ransomware data-leak (extortion) site on 2025-04-11.
Sfrent.net was named on the Play ransomware data-leak (extortion) site on 2025-04-11.
The Study was named on the Play ransomware data-leak (extortion) site on 2025-04-11.
3P Corporation was named on the Spacebears ransomware data-leak (extortion) site on 2025-04-10.
Bonick Landscaping was named on the Play ransomware data-leak (extortion) site on 2025-04-10.
Cane Creek Cycling Components was named on the Play ransomware data-leak (extortion) site on 2025-04-10.
chesterfieldtwp.org was named on the Incransom ransomware data-leak (extortion) site on 2025-04-10.
finetech.de was named on the Incransom ransomware data-leak (extortion) site on 2025-04-10.
inspec-international.com was named on the Incransom ransomware data-leak (extortion) site on 2025-04-10.
silocaf.com was named on the Incransom ransomware data-leak (extortion) site on 2025-04-10.
ccso2014.local(sheriffs) was named on the Incransom ransomware data-leak (extortion) site on 2025-04-09.
gramoll.com was named on the Lynx ransomware data-leak (extortion) site on 2025-04-09.
Coop57 was named on the Incransom ransomware data-leak (extortion) site on 2025-04-08.
crystal-d.com was named on the LockBit ransomware data-leak (extortion) site on 2025-04-08.
https://www.thirdave.com was named on the Metaencryptor ransomware data-leak (extortion) site on 2025-04-08.
physiciansmedicalbilling.net was named on the LockBit ransomware data-leak (extortion) site on 2025-04-08.
RFMS, Inc. was named on the Kairos ransomware data-leak (extortion) site on 2025-04-08.
shengyusteel.com was named on the Underground ransomware data-leak (extortion) site on 2025-04-08.
Thiekon Constructie was named on the Incransom ransomware data-leak (extortion) site on 2025-04-08.
[DISCLOSED]Cell C was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-04-07.
Galesburg Area Chamber of Commerce was named on the Kairos ransomware data-leak (extortion) site on 2025-04-07.
IDS Infotech was named on the Hunters International ransomware data-leak (extortion) site on 2025-04-07.
Telecontrol was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-04-07.
asiapacificex.com was named on the LockBit ransomware data-leak (extortion) site on 2025-04-06.
graphiquedefrance.com was named on the LockBit ransomware data-leak (extortion) site on 2025-04-06.
Groupe Delcourt was named on the Hunters International ransomware data-leak (extortion) site on 2025-04-06.
grupotersa.com.mx was named on the LockBit ransomware data-leak (extortion) site on 2025-04-06.
Hofmann Fรถrdertechnik GmbH was named on the Hunters International ransomware data-leak (extortion) site on 2025-04-06.
Swiss Capitals Group was named on the Rhysida ransomware data-leak (extortion) site on 2025-04-06.
ABITL Finishing was named on the Play ransomware data-leak (extortion) site on 2025-04-05.
Baltimore Steel Erectors was named on the Play ransomware data-leak (extortion) site on 2025-04-05.
Blackmon Mooring was named on the Hunters International ransomware data-leak (extortion) site on 2025-04-05.
Csm Engineering was named on the Play ransomware data-leak (extortion) site on 2025-04-05.
Hawk Technology was named on the Play ransomware data-leak (extortion) site on 2025-04-05.
https://www.mmwec.org was named on the BlackSuit ransomware data-leak (extortion) site on 2025-04-05.
Industrial Corona de Mรฉxico was named on the Spacebears ransomware data-leak (extortion) site on 2025-04-05.
L&S Mechanical (Reuploaded) was named on the Spacebears ransomware data-leak (extortion) site on 2025-04-05.
Nexia Poyiadjis IT was named on the Hunters International ransomware data-leak (extortion) site on 2025-04-05.
TEDOM was named on the Hunters International ransomware data-leak (extortion) site on 2025-04-05.
Fraser Trebilcock was named on the Play ransomware data-leak (extortion) site on 2025-04-04.
National Sign corp was named on the Hunters International ransomware data-leak (extortion) site on 2025-04-04.
Royal Glass was named on the Play ransomware data-leak (extortion) site on 2025-04-04.
Sansone Group was named on the Hunters International ransomware data-leak (extortion) site on 2025-04-04.
Alton Steel was named on the Lynx ransomware data-leak (extortion) site on 2025-04-03.
Hop Industries was named on the Play ransomware data-leak (extortion) site on 2025-04-03.
Lifebreath was named on the Play ransomware data-leak (extortion) site on 2025-04-03.
OTA Management was named on the Play ransomware data-leak (extortion) site on 2025-04-03.
Parvin-Clauss Sign Company was named on the Play ransomware data-leak (extortion) site on 2025-04-03.
Regionale Verkehrsbetriebe was named on the Play ransomware data-leak (extortion) site on 2025-04-03.
A little gift of exclusive data for everyone was named on the Daixin ransomware data-leak (extortion) site on 2025-04-02.
Clarity Ventures was named on the Rhysida ransomware data-leak (extortion) site on 2025-04-02.
crownlaboratories.com was named on the Abyss ransomware data-leak (extortion) site on 2025-04-02.
Fulfillment Plus was named on the Play ransomware data-leak (extortion) site on 2025-04-02.
The Hoff Brand SL Data Leak was named on the Everest ransomware data-leak (extortion) site on 2025-04-02.
delta-life.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-04-01.
europtec.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-04-01.
intellioan.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-04-01.
State's Attorney Office was named on the Kairos ransomware data-leak (extortion) site on 2025-04-01.
The Loretto Hospital was named on the Incransom ransomware data-leak (extortion) site on 2025-04-01.
CMC Technology Group was named on the BianLian ransomware data-leak (extortion) site on 2025-03-31.
Meridian Senior was named on the BianLian ransomware data-leak (extortion) site on 2025-03-31.
Saunders and Saunders was named on the BianLian ransomware data-leak (extortion) site on 2025-03-31.
SIRIUS S.R.L. was named on the Nitrogen ransomware data-leak (extortion) site on 2025-03-31.
Sonrisas Dental Health was named on the BianLian ransomware data-leak (extortion) site on 2025-03-31.
test1234.com was named on the LockBit ransomware data-leak (extortion) site on 2025-03-31.
www.assisi.nl was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-30.
AJF Inspections & Engineering () was named on the Lynx ransomware data-leak (extortion) site on 2025-03-29.
Amatech was named on the Lynx ransomware data-leak (extortion) site on 2025-03-29.
bahnlog.com was named on the Incransom ransomware data-leak (extortion) site on 2025-03-29.
Commercial Concrete Systems was named on the Lynx ransomware data-leak (extortion) site on 2025-03-29.
Forrest City School District was named on the Rhysida ransomware data-leak (extortion) site on 2025-03-29.
importantsteps.com was named on the Incransom ransomware data-leak (extortion) site on 2025-03-29.
Martin Mechanical (martin.local) was named on the Lynx ransomware data-leak (extortion) site on 2025-03-29.
Pacific Residential Mortgage was named on the Lynx ransomware data-leak (extortion) site on 2025-03-29.
Senior Support Services was named on the Rhysida ransomware data-leak (extortion) site on 2025-03-29.
Solar Optimum was named on the Lynx ransomware data-leak (extortion) site on 2025-03-29.
solaroptimum.com was named on the Lynx ransomware data-leak (extortion) site on 2025-03-29.
amatechinc.com was named on the Lynx ransomware data-leak (extortion) site on 2025-03-28.
augustssons.se was named on the Incransom ransomware data-leak (extortion) site on 2025-03-28.
Direct Traffic Control was named on the Lynx ransomware data-leak (extortion) site on 2025-03-28.
entandallergy.com was named on the Abyss ransomware data-leak (extortion) site on 2025-03-28.
phaus.us&phakr.com&phabodysystems.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-28.
W*******w.com was named on the Flocker ransomware data-leak (extortion) site on 2025-03-28.
www.bassi.it was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-28.
www.solventacentroamerica.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-28.
brattenelectrictn.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-27.
City of Fort St. John (city.cityfsj.local) was named on the Incransom ransomware data-leak (extortion) site on 2025-03-27.
conterra.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-27.
NEW JERSEY CPA was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-03-27.
www.allmilmoe.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-27.
www.carolinaac.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-27.
www.DSelectrical.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-27.
www.garbinc.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-27.
www.hongthongrice.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-27.
www.s3s.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-27.
www.solidworld.it was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-27.
Concord Orthopaedics Data Leak was named on the Everest ransomware data-leak (extortion) site on 2025-03-26.
Genie Healthcare Data Leak was named on the Everest ransomware data-leak (extortion) site on 2025-03-26.
TriCity Family Services was named on the Incransom ransomware data-leak (extortion) site on 2025-03-26.
usCalibration was named on the Play ransomware data-leak (extortion) site on 2025-03-26.
www.afnigc.ca was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-26.
www.argentosc.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-26.
www.cormidom.com.do was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-26.
www.creativelogisticservices.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-26.
www.fkm-elemente.de was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-26.
www.lions-online.org was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-26.
www.mododoc.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-26.
www.ripplejunction.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-26.
B&C Industries was named on the Play ransomware data-leak (extortion) site on 2025-03-25.
bioclimaservice.it was named on the LockBit ransomware data-leak (extortion) site on 2025-03-25.
cisd.org was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-25.
fepasa.com.ar was named on the LockBit ransomware data-leak (extortion) site on 2025-03-25.
Kimco Steel was named on the Play ransomware data-leak (extortion) site on 2025-03-25.
mnm.hu was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-25.
Okeene Elementary School was named on the Rhysida ransomware data-leak (extortion) site on 2025-03-25.
OMLTD.CO.JP was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-25.
ossc.com.mx was named on the LockBit ransomware data-leak (extortion) site on 2025-03-25.
technicare.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-25.
texascompressionservices.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-25.
www.rivaldt.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-25.
allbiz.com was named on the Incransom ransomware data-leak (extortion) site on 2025-03-24.
Lupin Limited was named on the Killsecurity ransomware data-leak (extortion) site on 2025-03-24.
TMT Clam Dredger was named on the Incransom ransomware data-leak (extortion) site on 2025-03-24.
www.exemplar.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-24.
abeyor.fr was named on the Incransom ransomware data-leak (extortion) site on 2025-03-23.
Goshen Medical Center was named on the BianLian ransomware data-leak (extortion) site on 2025-03-23.
Precision Accounting Intl was named on the Killsecurity ransomware data-leak (extortion) site on 2025-03-23.
Doumen was named on the Lynx ransomware data-leak (extortion) site on 2025-03-22.
Innovative Surfaces was named on the Killsecurity ransomware data-leak (extortion) site on 2025-03-22.
REOC San Antonio was named on the Play ransomware data-leak (extortion) site on 2025-03-22.
SPARSH Hospital was named on the Killsecurity ransomware data-leak (extortion) site on 2025-03-22.
Zaveta Custom Homes was named on the Play ransomware data-leak (extortion) site on 2025-03-22.
Cayman National Bank was named on the Killsecurity ransomware data-leak (extortion) site on 2025-03-21.
gbsn.com.br was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-21.
https://www.orangeville.ca was named on the BlackSuit ransomware data-leak (extortion) site on 2025-03-21.
Officio Medical was named on the Killsecurity ransomware data-leak (extortion) site on 2025-03-21.
www.abmenviro.ca was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-21.
www.accessfinanceonline.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-21.
www.ahmadiyya.ca was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-21.
www.allstarhealthcaresolutions.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-21.
www.avalonapparel.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-21.
www.broadmoormethodist.org was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-21.
www.core-1.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-21.
www.elizajennings.org was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-21.
www.engines.man.eu was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-21.
www.esquirebrands.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-21.
www.gcsnet.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-21.
www.gestionquintessence.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-21.
www.mslglobalexp.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-21.
www.njcalwe.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-21.
www.oneupinnovations.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-21.
www.parklandmanufacturing.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-21.
www.scpautomation.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-21.
www.sinkdirect.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-21.
www.solinst.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-21.
Cargills Bank was named on the Hunters International ransomware data-leak (extortion) site on 2025-03-20.
Instituto de Ojos was named on the Killsecurity ransomware data-leak (extortion) site on 2025-03-20.
interiseworld.com was named on the Killsecurity ransomware data-leak (extortion) site on 2025-03-20.
L&S Mechanical was named on the Spacebears ransomware data-leak (extortion) site on 2025-03-20.
Megacentro was named on the Hunters International ransomware data-leak (extortion) site on 2025-03-20.
Newtown Friends School (newtownfriends.org) was named on the FOG ransomware data-leak (extortion) site on 2025-03-20.
Obra Play was named on the Killsecurity ransomware data-leak (extortion) site on 2025-03-20.
Whittaker & Company was named on the Spacebears ransomware data-leak (extortion) site on 2025-03-20.
www.georgehay.co.uk was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-20.
www.janvier-labs.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-20.
yano.tokyo was named on the Blackout ransomware data-leak (extortion) site on 2025-03-20.
alphaoil.ca was named on the Incransom ransomware data-leak (extortion) site on 2025-03-19.
controlledair.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-19.
Coopertruni was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-03-19.
Kiribati Government was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-03-19.
newhollandwood.com was named on the Incransom ransomware data-leak (extortion) site on 2025-03-19.
Palomino Petroleum was named on the Lynx ransomware data-leak (extortion) site on 2025-03-19.
Q railing was named on the Play ransomware data-leak (extortion) site on 2025-03-19.
THX Transport was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-03-19.
warmsworth.doncaster.sch.uk was named on the Incransom ransomware data-leak (extortion) site on 2025-03-19.
51talk.com was named on the LockBit ransomware data-leak (extortion) site on 2025-03-18.
airtelligence.com was named on the Incransom ransomware data-leak (extortion) site on 2025-03-18.
AMICIO was named on the Lynx ransomware data-leak (extortion) site on 2025-03-18.
CD was named on the Monti ransomware data-leak (extortion) site on 2025-03-18.
expertdata.com.au was named on the Incransom ransomware data-leak (extortion) site on 2025-03-18.
gaertnerhof-jeutter.de was named on the Incransom ransomware data-leak (extortion) site on 2025-03-18.
Gloria Cales was named on the Monti ransomware data-leak (extortion) site on 2025-03-18.
Harcourts Prime Properties was named on the Killsecurity ransomware data-leak (extortion) site on 2025-03-18.
Ted Hosmer Enterprises was named on the Rhysida ransomware data-leak (extortion) site on 2025-03-18.
assaabloy.com\$14.4B\Sweden\229GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-17.
baillie.com\$130.5M\USA\52GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-17.
bluedge.com\$104.5M\USA\994GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-17.
CableVision was named on the Hunters International ransomware data-leak (extortion) site on 2025-03-17.
ccktech.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-17.
kyb.com\$600.5M\USA\1.8TB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-17.
oneill.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-17.
RAE (Real Academia Espaรฑola) (rae.es) was named on the FOG ransomware data-leak (extortion) site on 2025-03-17.
rocketstores.com\$738.9M\USA\3.2TB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-17.
tempel.com\$628.7M\USA\111GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-17.
thermoid.com\$183.2M\USA\199GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-17.
urban1.com\$460.3M\USA\2.5TB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-17.
www.baxterlaboratories.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-17.
www.jhayber.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-17.
Courageous Home Care was named on the Hunters International ransomware data-leak (extortion) site on 2025-03-16.
www.ameda.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-16.
yeanshalle.de was named on the Incransom ransomware data-leak (extortion) site on 2025-03-15.
Bancroft Wines was named on the Incransom ransomware data-leak (extortion) site on 2025-03-14.
Casale Del Giglio was named on the Orca ransomware data-leak (extortion) site on 2025-03-14.
Fulcrum Lifting was named on the Lynx ransomware data-leak (extortion) site on 2025-03-14.
idcconstruction.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-14.
Indiv Usa was named on the Lynx ransomware data-leak (extortion) site on 2025-03-14.
jennyyoo.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-14.
mdm-insurance.com was named on the Abyss ransomware data-leak (extortion) site on 2025-03-14.
Perrigo Company was named on the Termite ransomware data-leak (extortion) site on 2025-03-14.
Tryon was named on the Lynx ransomware data-leak (extortion) site on 2025-03-14.
Backes was named on the Play ransomware data-leak (extortion) site on 2025-03-13.
Best Cheer Stone was named on the Play ransomware data-leak (extortion) site on 2025-03-13.
chfindustries.com\$253.8M\USA\2.5TB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-13.
Cothron's Security Professionals was named on the Rhysida ransomware data-leak (extortion) site on 2025-03-13.
dtrglaw.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-13.
fstlogistics.com was named on the Lynx ransomware data-leak (extortion) site on 2025-03-13.
Harrells.com was named on the Lynx ransomware data-leak (extortion) site on 2025-03-13.
muellersyste was named on the LockBit ransomware data-leak (extortion) site on 2025-03-13.
rixos.com was named on the Embargo ransomware data-leak (extortion) site on 2025-03-13.
SL Tennessee Information was named on the Play ransomware data-leak (extortion) site on 2025-03-13.
University Diagnostic Medical Imaging, PC (udmi.net) was named on the FOG ransomware data-leak (extortion) site on 2025-03-13.
www.raymond.in was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-13.
baillie.com\$130.5M\USA\52GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-12.
El Camino Real Academy (elcaminorealacademy) was named on the FOG ransomware data-leak (extortion) site on 2025-03-12.
HYPERNOVA TELECOM was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-03-12.
HYPONAMIRU was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-03-12.
rocketstores.com\$738.9M\USA\3.2TB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-12.
tempel.com\$628.7M\USA\111GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-12.
thermoid.com\$183.2M\USA\199GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-12.
TUV India Pvt. Ltd. was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-03-12.
urban1.com\$460.3M\USA\2.5TB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-12.
www.visualisation.one was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-12.
ciscientific.com.au was named on the Lynx ransomware data-leak (extortion) site on 2025-03-11.
Edesur Dominicana was named on the Hunters International ransomware data-leak (extortion) site on 2025-03-11.
Essex County OB/GYN Associates was named on the Incransom ransomware data-leak (extortion) site on 2025-03-11.
Longue Vue Club was named on the Lynx ransomware data-leak (extortion) site on 2025-03-11.
quigleyeye.com\$33.6M\USA\3.4TB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-11.
Research Electronics International was named on the Nitrogen ransomware data-leak (extortion) site on 2025-03-11.
Skyward Specialty Insurance was named on the Killsecurity ransomware data-leak (extortion) site on 2025-03-11.
Springfield Water and Sewer Commission was named on the Lynx ransomware data-leak (extortion) site on 2025-03-11.
Trymata was named on the Killsecurity ransomware data-leak (extortion) site on 2025-03-11.
Wilkinson Rogers (wilkinsonrogers.com) was named on the FOG ransomware data-leak (extortion) site on 2025-03-11.
wmk-hvb.de was named on the Incransom ransomware data-leak (extortion) site on 2025-03-11.
aiibeauty.com\$274.8M\USA\508GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-10.
amalgamatedsugar.com\$764.8 M\USA\464GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-10.
caltrol.com\$296.3M\USA\224GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-10.
dccsagroup.com&csahome.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-10.
[DISCLOSED]Nationz Technologies Inc. was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-03-10.
formanmills.com\$422.2M\USA\846GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-10.
Fred Salvucci was named on the Kairos ransomware data-leak (extortion) site on 2025-03-10.
Magnolia Manor (magnoliamanor.com) was named on the FOG ransomware data-leak (extortion) site on 2025-03-10.
pace-usa.com\$134.4M\USA\65GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-10.
steelwarehouse.com\$570.3M\USA\679GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-10.
www.hexosys.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-10.
ACTi Corporation was named on the Lynx ransomware data-leak (extortion) site on 2025-03-09.
baldaufarchitekten.de was named on the Incransom ransomware data-leak (extortion) site on 2025-03-09.
BerksBar.org was named on the Incransom ransomware data-leak (extortion) site on 2025-03-09.
British virgin islands London Office was named on the Rhysida ransomware data-leak (extortion) site on 2025-03-09.
Buckley BalaWilson Mew was named on the Play ransomware data-leak (extortion) site on 2025-03-09.
Clawson Honda was named on the Play ransomware data-leak (extortion) site on 2025-03-09.
Compound Solutions was named on the Play ransomware data-leak (extortion) site on 2025-03-09.
Dectron was named on the Play ransomware data-leak (extortion) site on 2025-03-09.
emperors.edu was named on the Incransom ransomware data-leak (extortion) site on 2025-03-09.
Gevril was named on the Play ransomware data-leak (extortion) site on 2025-03-09.
Greenwood Village South GVS was named on the Incransom ransomware data-leak (extortion) site on 2025-03-09.
Holiday Comfort was named on the Play ransomware data-leak (extortion) site on 2025-03-09.
Insider Technologies Limited was named on the Embargo ransomware data-leak (extortion) site on 2025-03-09.
Jerue Companies was named on the Play ransomware data-leak (extortion) site on 2025-03-09.
Nor Arc was named on the Play ransomware data-leak (extortion) site on 2025-03-09.
Peak Season was named on the Play ransomware data-leak (extortion) site on 2025-03-09.
Salemerode.com was named on the Flocker ransomware data-leak (extortion) site on 2025-03-09.
State Bar of Texas (www.texasbar.com) was named on the Incransom ransomware data-leak (extortion) site on 2025-03-09.
Syma-System was named on the Play ransomware data-leak (extortion) site on 2025-03-09.
T J Machine & Tool was named on the Play ransomware data-leak (extortion) site on 2025-03-09.
williampevear.com was named on the Incransom ransomware data-leak (extortion) site on 2025-03-09.
wog-kaiserbaeder.de was named on the Incransom ransomware data-leak (extortion) site on 2025-03-09.
Yorke & Curtis was named on the Play ransomware data-leak (extortion) site on 2025-03-09.
mitchellmcnutt.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-08.
Tech NH was named on the Lynx ransomware data-leak (extortion) site on 2025-03-08.
www.dcarosolutions.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-08.
www.jpwindustries.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-08.
ACDC Express was named on the Lynx ransomware data-leak (extortion) site on 2025-03-07.
Allworx was named on the BianLian ransomware data-leak (extortion) site on 2025-03-07.
alphabaking.com\$421.9M\USA\1TB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-07.
associatedasset.com\$288M\USA\26GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-07.
bayvillage.org was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-07.
grede.com\$814.7M\USA\524GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-07.
Island Realty was named on the BianLian ransomware data-leak (extortion) site on 2025-03-07.
lofotenseafood.com was named on the Lynx ransomware data-leak (extortion) site on 2025-03-07.
Minnesota Orthodontics was named on the BianLian ransomware data-leak (extortion) site on 2025-03-07.
REYCOTEL was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-03-07.
srmg.com.au was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-07.
total-ps.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-07.
wheats.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-07.
Adval Tech was named on the Lynx ransomware data-leak (extortion) site on 2025-03-06.
agi.net was named on the Monti ransomware data-leak (extortion) site on 2025-03-06.
Dynamic Closures was named on the Lynx ransomware data-leak (extortion) site on 2025-03-06.
electrocraft.com\$190.1M\USA\477GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-06.
hickorylaw.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-06.
holtcat.com\$1B\USA\868GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-06.
lovesac.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-06.
Naples Heritage Golf & Country Club was named on the Incransom ransomware data-leak (extortion) site on 2025-03-06.
Oberlin Cable Co-op (oberlin.net) was named on the FOG ransomware data-leak (extortion) site on 2025-03-06.
stanleyconsultants.com\$190.5M\USA\388GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-06.
Tugwell Pump & Supply was named on the Lynx ransomware data-leak (extortion) site on 2025-03-06.
WJCC Public Schools (wjccschools.org) was named on the FOG ransomware data-leak (extortion) site on 2025-03-06.
www.centersheetmetal.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-06.
www.convention.qc.ca was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-06.
www.hinton.ca was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-06.
www.portlandschools.org was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-06.
Best Collateral, Inc. was named on the Rhysida ransomware data-leak (extortion) site on 2025-03-05.
Pervedant was named on the Lynx ransomware data-leak (extortion) site on 2025-03-05.
Schmiedetechnik Plettenberg GmbH & Co KG was named on the Lynx ransomware data-leak (extortion) site on 2025-03-05.
SCOLARO FETTER GRIZANTI & McGOUGH, P.C. (scolaro.com) was named on the FOG ransomware data-leak (extortion) site on 2025-03-05.
The 19 biggest gitlabs was named on the FOG ransomware data-leak (extortion) site on 2025-03-05.
USA Rice<br /> was named on the Kairos ransomware data-leak (extortion) site on 2025-03-05.
www.black-star.fr was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-05.
www.cda.be was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-05.
www.japanrebuilt.jp was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-05.
www.sunsweet.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-05.
365labs - Security Corp was named on the Monti ransomware data-leak (extortion) site on 2025-03-04.
Brien, Inc. was named on the BianLian ransomware data-leak (extortion) site on 2025-03-04.
dsrny.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-04.
Ewald Consulting was named on the BianLian ransomware data-leak (extortion) site on 2025-03-04.
Garner, P.C. was named on the BianLian ransomware data-leak (extortion) site on 2025-03-04.
goencon.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-04.
Grupo Baston Aerossol (baston.com.br) was named on the FOG ransomware data-leak (extortion) site on 2025-03-04.
Keystone Pacific Property Management LLC was named on the BianLian ransomware data-leak (extortion) site on 2025-03-04.
Layfield and Borel CPA's L.L.C was named on the BianLian ransomware data-leak (extortion) site on 2025-03-04.
Legal Aid Society of Salt Lake was named on the BianLian ransomware data-leak (extortion) site on 2025-03-04.
Pampili (pampili.com.br) was named on the FOG ransomware data-leak (extortion) site on 2025-03-04.
Phoenix was named on the Monti ransomware data-leak (extortion) site on 2025-03-04.
Seabank Group was named on the Lynx ransomware data-leak (extortion) site on 2025-03-04.
Tata Technologies was named on the Hunters International ransomware data-leak (extortion) site on 2025-03-04.
Wendy Wu Tours was named on the Killsecurity ransomware data-leak (extortion) site on 2025-03-04.
almostfamousclothing.com\$183M\USA\375GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-03.
andreyevengineering.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-03.
Central McGowan (centralmcgowan.com) was named on the FOG ransomware data-leak (extortion) site on 2025-03-03.
ceratec.com was named on the Abyss ransomware data-leak (extortion) site on 2025-03-03.
everelgroup.com\$259M\Italy\440GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-03.
familychc.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-03-03.
Grafitec was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-03-03.
ICO was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-03-03.
Itapeseg was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-03-03.
K**d.edu was named on the Flocker ransomware data-leak (extortion) site on 2025-03-03.
Klesk Metal Stamping Co (kleskmetalstamping.com) was named on the FOG ransomware data-leak (extortion) site on 2025-03-03.
La Uniรณn was named on the Lynx ransomware data-leak (extortion) site on 2025-03-03.
LINKGROUP was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-03-03.
logic insectes was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-03-03.
New .Gov ? was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-03-03.
Openreso was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-03-03.
quigleyeye.com\$33.6M\USA\435GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-03.
regulvar.com\$253.5M\Canada\3.6TB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-03.
RJ IT Solutions was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-03-03.
S********e.com was named on the Flocker ransomware data-leak (extortion) site on 2025-03-03.
ssmcoop.com\$22.5M\USA\26GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-03.
synaptic.co.tz was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-03-03.
Vitenas Cosmetic Surgery was named on the Kairos ransomware data-leak (extortion) site on 2025-03-03.
bestbrands.com\$25.5M\USA\659GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-02.
britannicahome.com\$20.6M\USA\2.8TB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-02.
Couri Insurance Agency was named on the Play ransomware data-leak (extortion) site on 2025-03-02.
FM.GOB.AR was named on the Monti ransomware data-leak (extortion) site on 2025-03-02.
Ganong Bros was named on the Play ransomware data-leak (extortion) site on 2025-03-02.
germancentre.sg was named on the Incransom ransomware data-leak (extortion) site on 2025-03-02.
gruppocogesi.org was named on the LockBit ransomware data-leak (extortion) site on 2025-03-02.
International Process Plants was named on the Play ransomware data-leak (extortion) site on 2025-03-02.
IT-IQ Botswana was named on the Play ransomware data-leak (extortion) site on 2025-03-02.
kinseysinc.com\$74.9M\USA\675GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-02.
M&n Management was named on the Play ransomware data-leak (extortion) site on 2025-03-02.
midwayimporting.com\$43.7M\USA\915GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-02.
newhorizonsbaking.com\$163M\USA\455GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-02.
North American Fire Hose was named on the Play ransomware data-leak (extortion) site on 2025-03-02.
Optometrics was named on the Play ransomware data-leak (extortion) site on 2025-03-02.
Pre Con Industries was named on the Play ransomware data-leak (extortion) site on 2025-03-02.
revitalash.com\$21.5M\USA\1.2TB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-02.
steelerubber.com\$17.9M\USA\116GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-02.
uniekinc.com\$37.5M\USA\1.8TB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-03-02.
Workforce Group was named on the Killsecurity ransomware data-leak (extortion) site on 2025-03-02.
breakawayconcretecutting.com was named on the Incransom ransomware data-leak (extortion) site on 2025-03-01.
Newton & Associates, Inc was named on the Rhysida ransomware data-leak (extortion) site on 2025-03-01.
associatedasset.com\$288M\USA\26GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-28.
branchgroup.com\$333M\USA\253GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-28.
curtisint.com\$37.2M\Canada\676GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-28.
electrocraft.com\$190.1M\USA\477GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-28.
Engineering Mechanics was named on the Lynx ransomware data-leak (extortion) site on 2025-02-28.
grede.com\$814.7M\USA\524gb\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-28.
Inversiones Clinica Del Meta SA was named on the Ransomblog_noname ransomware data-leak (extortion) site on 2025-02-28.
pace-usa.com\$134.4M\USA\65gb\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-28.
stanleyconsultants.com\$190.5M\USA\388GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-28.
steelwarehouse.com\$570.3M\USA\679gb\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-28.
sublettecountywy.gov was named on the Incransom ransomware data-leak (extortion) site on 2025-02-28.
uniquehd.com\$13.7M\USA\429GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-28.
www.casinoessentials.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-28.
www.journeyoilfield.net was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-28.
Biogena GmbH & Co KG was named on the Lynx ransomware data-leak (extortion) site on 2025-02-27.
jtu.com.br was named on the LockBit ransomware data-leak (extortion) site on 2025-02-27.
teamwass.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-27.
www.nasonptc.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-27.
www.townofbourne.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-27.
3cBSI was named on the Play ransomware data-leak (extortion) site on 2025-02-26.
alphabaking.com\$421.9M\USA\1TB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-26.
Arcandco was named on the Termite ransomware data-leak (extortion) site on 2025-02-26.
caltrol.com\$296.3M\USA\224gb\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-26.
Finck Cigar was named on the Play ransomware data-leak (extortion) site on 2025-02-26.
Genea was named on the Termite ransomware data-leak (extortion) site on 2025-02-26.
Gitlabs: Synelixis Solutions, INGV, VMO Holdings was named on the FOG ransomware data-leak (extortion) site on 2025-02-26.
holtcat.com\$1B\USA\868GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-26.
ITU AbsorbTech was named on the Lynx ransomware data-leak (extortion) site on 2025-02-26.
Kendall Auto Group was named on the Hunters International ransomware data-leak (extortion) site on 2025-02-26.
London Belgravia was named on the Termite ransomware data-leak (extortion) site on 2025-02-26.
Muller Insurance was named on the Play ransomware data-leak (extortion) site on 2025-02-26.
National Legal Service was named on the Termite ransomware data-leak (extortion) site on 2025-02-26.
Nationz Technologies Inc. was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-02-26.
Nichino Ryokka Co Ltd was named on the Hunters International ransomware data-leak (extortion) site on 2025-02-26.
Omni United was named on the Hunters International ransomware data-leak (extortion) site on 2025-02-26.
powelltool.com was named on the Lynx ransomware data-leak (extortion) site on 2025-02-26.
Rooks Rider Solicitors was named on the Termite ransomware data-leak (extortion) site on 2025-02-26.
Story Environmental was named on the Play ransomware data-leak (extortion) site on 2025-02-26.
Vermeer Mexico was named on the Hunters International ransomware data-leak (extortion) site on 2025-02-26.
www.amerasphalt.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-26.
www.cmsg.cl was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-26.
www.emeryair.net was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-26.
www.envirolabsinc.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-26.
www.kppm.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-26.
www.newburghhealthcarecenter.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-26.
www.obrienavocats.qc.ca was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-26.
acmefan.com was named on the Lynx ransomware data-leak (extortion) site on 2025-02-25.
ALCOTT HR GROUP was named on the Play ransomware data-leak (extortion) site on 2025-02-25.
bluedge.com\$104.5M\USA\994GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-25.
Convert Solar was named on the Play ransomware data-leak (extortion) site on 2025-02-25.
essenzamovies.com.br was named on the LockBit ransomware data-leak (extortion) site on 2025-02-25.
Fairhaven Shipyard Companies was named on the Play ransomware data-leak (extortion) site on 2025-02-25.
First Federal Savings & Loan was named on the Play ransomware data-leak (extortion) site on 2025-02-25.
GANRO was named on the Lynx ransomware data-leak (extortion) site on 2025-02-25.
hgmlegal.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-25.
lifting.com\$135.8M\USA\1.4TB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-25.
megamtls.com was named on the Incransom ransomware data-leak (extortion) site on 2025-02-25.
neatem.fr | Update! was named on the Braincipher ransomware data-leak (extortion) site on 2025-02-25.
ossc.mx was named on the LockBit ransomware data-leak (extortion) site on 2025-02-25.
pacresmortgage.com was named on the Lynx ransomware data-leak (extortion) site on 2025-02-25.
PPS Services Group was named on the Lynx ransomware data-leak (extortion) site on 2025-02-25.
Radco Industries was named on the Play ransomware data-leak (extortion) site on 2025-02-25.
South Georgia Accounting Services was named on the Spacebears ransomware data-leak (extortion) site on 2025-02-25.
tequaly.com was named on the Embargo ransomware data-leak (extortion) site on 2025-02-25.
unila.edu.mx was named on the LockBit ransomware data-leak (extortion) site on 2025-02-25.
Vvf Ilinois Services was named on the Lynx ransomware data-leak (extortion) site on 2025-02-25.
welcompanies.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-25.
www.ateliermonarque.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-25.
www.avalon-hotel.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-25.
www.bwdtechnology.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-25.
www.confabca.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-25.
www.rgb.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-25.
www.wpisd.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-25.
Xepa Soul was named on the Lynx ransomware data-leak (extortion) site on 2025-02-25.
aiibeauty.com\$274.8M\USA\508GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-24.
amalgamatedsugar.com\$764.8 M\USA\464gb\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-24.
chfindustries.com\$253.8M\USA\2.5TB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-24.
compactmould.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-24.
denbyco.co.uk was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-24.
[DISCLOSED] Aishu, Eshoo was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-02-24.
everelgroup.com\$259M\Italy\440GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-24.
[EVIDENCE] Aishu, Eshoo was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-02-24.
Fireplace Warehouse was named on the Kairos ransomware data-leak (extortion) site on 2025-02-24.
formanmills.com\$422.2M\USA\846gb\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-24.
Geokon was named on the Lynx ransomware data-leak (extortion) site on 2025-02-24.
IDEA Expertises was named on the Lynx ransomware data-leak (extortion) site on 2025-02-24.
Planet One was named on the Lynx ransomware data-leak (extortion) site on 2025-02-24.
regulvar.com\$253.5M\Canada\3.6TB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-24.
Stรผrmer Maschinen was named on the Lynx ransomware data-leak (extortion) site on 2025-02-24.
BluAgent Technologies, Inc was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-23.
G& was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-23.
Gitlabs: Naphix, WDNA, Bayteq was named on the FOG ransomware data-leak (extortion) site on 2025-02-23.
Novi Community School District was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-23.
ondaralogistica.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-23.
Shaghalni was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-23.
www.famcomachine.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-23.
alleghenybradford.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-22.
CCOO Servicios was named on the Hunters International ransomware data-leak (extortion) site on 2025-02-22.
evergreenpnw.com was named on the Incransom ransomware data-leak (extortion) site on 2025-02-22.
Excel Security was named on the Lynx ransomware data-leak (extortion) site on 2025-02-22.
Peter Glenn Ski Sport was named on the Rhysida ransomware data-leak (extortion) site on 2025-02-22.
SPEED Co was named on the Hunters International ransomware data-leak (extortion) site on 2025-02-22.
teamsters175.org was named on the Incransom ransomware data-leak (extortion) site on 2025-02-22.
guadeloupeformation.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-21.
headcount.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-21.
jindalgroup.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-21.
(kc2) geokon.com was named on the Lynx ransomware data-leak (extortion) site on 2025-02-21.
planetone-asia.com was named on the Lynx ransomware data-leak (extortion) site on 2025-02-21.
statesideseattle.com was named on the Incransom ransomware data-leak (extortion) site on 2025-02-21.
www.elecgalapagos.com.ec was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-21.
www.electro-fusion.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-21.
www.fla-esq.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-21.
www.midwestvascular.net was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-21.
www.nola-law.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-21.
www.saracenproperties.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-21.
www.witheyaddison.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-21.
californiaclingpeaches.com was named on the Incransom ransomware data-leak (extortion) site on 2025-02-20.
eaglepost.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-20.
ehdd.com was named on the Incransom ransomware data-leak (extortion) site on 2025-02-20.
Fortune Electric Co Ltd was named on the Lynx ransomware data-leak (extortion) site on 2025-02-20.
gilcar.co was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-20.
Ligentia was named on the Termite ransomware data-leak (extortion) site on 2025-02-20.
Medical File was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-20.
newhorizonsbaking.com\$163M\USA\455GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-20.
www.okddsi.net was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-20.
www.phdental.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-20.
www.pransystems.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-20.
www.riverdale.edu was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-20.
Alabama Ophthalmology Associates was named on the BianLian ransomware data-leak (extortion) site on 2025-02-19.
BeniPlus was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-19.
Brolly was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-19.
DR.Claims FL LLC was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-19.
Eservices.gov.zm was named on the Flocker ransomware data-leak (extortion) site on 2025-02-19.
EzyLegal was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-19.
Gitlabs: Next TI, VISEO, Hochschule Trier was named on the FOG ransomware data-leak (extortion) site on 2025-02-19.
Haggin Oaks Golf (hagginoaks.com) was named on the FOG ransomware data-leak (extortion) site on 2025-02-19.
haleycomfort.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-19.
Help Me Grow Yolo was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-19.
NimuSoft was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-19.
Pulmonary Physicians of South Florida Clinics | Data security breach! was named on the Braincipher ransomware data-leak (extortion) site on 2025-02-19.
Ranhill Bersekutu was named on the Lynx ransomware data-leak (extortion) site on 2025-02-19.
Revi was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-19.
Supreme Administrative Court of Bulgaria was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-02-19.
Afa Systems Ltd. was named on the Underground ransomware data-leak (extortion) site on 2025-02-18.
bestbrands.com\$25.5M\USA\659GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-18.
boostheat.com was named on the Bashe ransomware data-leak (extortion) site on 2025-02-18.
Buanderie Centrale de Montreal was named on the Rhysida ransomware data-leak (extortion) site on 2025-02-18.
lavi.co.il was named on the Incransom ransomware data-leak (extortion) site on 2025-02-18.
midwayimporting.com\$43.7M\USA\915GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-18.
pyasolutions.com was named on the Incransom ransomware data-leak (extortion) site on 2025-02-18.
ranhillbersekutu.com.my was named on the Lynx ransomware data-leak (extortion) site on 2025-02-18.
revitalash.com\$21.5M\USA\1.2TB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-18.
uniekinc.com\$37.5M\USA\1.8TB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-18.
www.alphamedctr.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-18.
www.ccttechnologies.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-18.
www.copleystoughton.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-18.
www.macmed.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-18.
www.mwmechanicalinc.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-18.
Allied Tenesis was named on the Lynx ransomware data-leak (extortion) site on 2025-02-17.
almostfamousclothing.com\$183M\USA\375GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-17.
Autoschade Pippel was named on the Lynx ransomware data-leak (extortion) site on 2025-02-17.
bisindustries.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-17.
Bulldog Oilfield Services was named on the Play ransomware data-leak (extortion) site on 2025-02-17.
Bushmans was named on the Play ransomware data-leak (extortion) site on 2025-02-17.
Cirion Technologies was named on the Braincipher ransomware data-leak (extortion) site on 2025-02-17.
Cuna Supply was named on the Play ransomware data-leak (extortion) site on 2025-02-17.
Dane Court Grammar School was named on the Kairos ransomware data-leak (extortion) site on 2025-02-17.
Greencastle-Antrim Senior High School (gcasd.org) was named on the FOG ransomware data-leak (extortion) site on 2025-02-17.
hamton was named on the Lynx ransomware data-leak (extortion) site on 2025-02-17.
Hisingstads Bleck was named on the Lynx ransomware data-leak (extortion) site on 2025-02-17.
HRS_IDEA_Expertises was named on the Lynx ransomware data-leak (extortion) site on 2025-02-17.
https://www.dapope.com/ was named on the BlackSuit ransomware data-leak (extortion) site on 2025-02-17.
Inland Empire Distribution Systems, Inc. was named on the Play ransomware data-leak (extortion) site on 2025-02-17.
kinseysinc.com\$74.9M\USA\675GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-17.
Leadership Strategies was named on the Lynx ransomware data-leak (extortion) site on 2025-02-17.
lekiaviation.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-17.
LINTEC & LINNHOFF Holdings was named on the Lynx ransomware data-leak (extortion) site on 2025-02-17.
mgainnovation.com\$30.9M\USA\215GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-17.
myhscu.com was named on the Embargo ransomware data-leak (extortion) site on 2025-02-17.
neatem.fr was named on the Braincipher ransomware data-leak (extortion) site on 2025-02-17.
northernresponse.com\$17.4M\Canada\366GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-17.
Oxford Companies was named on the Play ransomware data-leak (extortion) site on 2025-02-17.
Pedensia Graphics Distribution was named on the Lynx ransomware data-leak (extortion) site on 2025-02-17.
Persante Health Care was named on the Incransom ransomware data-leak (extortion) site on 2025-02-17.
Rheinischer Sch was named on the Play ransomware data-leak (extortion) site on 2025-02-17.
savoiesfoods.com\$18.2M\USA\95GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-17.
ssmcoop.com\$22.5M\USA\26GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-17.
Stage 3 Separation was named on the Play ransomware data-leak (extortion) site on 2025-02-17.
Startek Peglar & Calcagni was named on the Play ransomware data-leak (extortion) site on 2025-02-17.
steelerubber.com\$17.9M\USA\116GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-17.
Swissmem was named on the Hunters International ransomware data-leak (extortion) site on 2025-02-17.
teamwass.com\$676.3M\USA\451GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-17.
The Townsley Law Firm Information was named on the Play ransomware data-leak (extortion) site on 2025-02-17.
Toi Toi USA was named on the Kairos ransomware data-leak (extortion) site on 2025-02-17.
Transkid was named on the Play ransomware data-leak (extortion) site on 2025-02-17.
Weed Man Canada was named on the Play ransomware data-leak (extortion) site on 2025-02-17.
Winbas was named on the Lynx ransomware data-leak (extortion) site on 2025-02-17.
www.macter.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-17.
Wylie Steel Fabricators was named on the Play ransomware data-leak (extortion) site on 2025-02-17.
A*u.edu.au was named on the Flocker ransomware data-leak (extortion) site on 2025-02-16.
annegrady.org was named on the Embargo ransomware data-leak (extortion) site on 2025-02-16.
Gitlabs: Acqua development, QBurst, Pamyra.de was named on the FOG ransomware data-leak (extortion) site on 2025-02-16.
Gpstech2007.com was named on the Flocker ransomware data-leak (extortion) site on 2025-02-16.
Mervis.info was named on the Flocker ransomware data-leak (extortion) site on 2025-02-16.
Realtime.tw was named on the Flocker ransomware data-leak (extortion) site on 2025-02-16.
City of McKinney was named on the Incransom ransomware data-leak (extortion) site on 2025-02-15.
Empire Home Center was named on the Lynx ransomware data-leak (extortion) site on 2025-02-15.
halex.com was named on the Abyss ransomware data-leak (extortion) site on 2025-02-15.
(M)Empire-home-center was named on the Lynx ransomware data-leak (extortion) site on 2025-02-15.
Northeast Delta Human Services Authority was named on the Incransom ransomware data-leak (extortion) site on 2025-02-15.
saulttribe.com/kewadin.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-15.
www.310tempering.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-15.
www.cityoftarrant.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-15.
www.colacouronnelocations.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-15.
www.imgenterprises.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-15.
www.naga.ae was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-15.
www.rowetactical.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-15.
www.solardatasystems.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-15.
www.transcend-info.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-15.
brockbanks.co.uk was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-14.
Heritage South Credit Union was named on the Embargo ransomware data-leak (extortion) site on 2025-02-14.
The Agency was named on the Rhysida ransomware data-leak (extortion) site on 2025-02-14.
www.calspa.it was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-14.
Aspire Rural Health System was named on the BianLian ransomware data-leak (extortion) site on 2025-02-13.
Ball, LLP was named on the BianLian ransomware data-leak (extortion) site on 2025-02-13.
Borel CPA's L.L.C was named on the BianLian ransomware data-leak (extortion) site on 2025-02-13.
Dain, Torpy, Le Ray, Wiest and Garner, P.C. was named on the BianLian ransomware data-leak (extortion) site on 2025-02-13.
enventuregt.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-13.
Financial Services of America, Inc. was named on the BianLian ransomware data-leak (extortion) site on 2025-02-13.
Gitlabs: Omydoo, Ayomi, ADULLACT was named on the FOG ransomware data-leak (extortion) site on 2025-02-13.
leonardo.com was named on the Threeam ransomware data-leak (extortion) site on 2025-02-13.
Mozo Grau (mozo-grau.com) was named on the FOG ransomware data-leak (extortion) site on 2025-02-13.
Nash Brothers Construction was named on the BianLian ransomware data-leak (extortion) site on 2025-02-13.
Nippon Steel USA was named on the BianLian ransomware data-leak (extortion) site on 2025-02-13.
R Molds Inc was named on the BianLian ransomware data-leak (extortion) site on 2025-02-13.
Shields Facilities Maintenance was named on the Play ransomware data-leak (extortion) site on 2025-02-13.
snoqualmietribe.us was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-13.
alderconstruction.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-12.
askgs.ma was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-12.
bergconst.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-12.
britannicahome.com\$20.6M\USA\2.8TB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-12.
burdickpainting.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-12.
columbiacabinets.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-12.
curtisint.com\$37.2M\Canada\676GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-12.
E*******s.gov.zm was named on the Flocker ransomware data-leak (extortion) site on 2025-02-12.
ekvallbyrne.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-12.
Gitlabs: INGV, Spacemanic, Squeezer-software was named on the FOG ransomware data-leak (extortion) site on 2025-02-12.
Hess (hess-gmbh.de) was named on the FOG ransomware data-leak (extortion) site on 2025-02-12.
http://thermaseal.net was named on the Ciphbit ransomware data-leak (extortion) site on 2025-02-12.
krmcustomhomes.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-12.
laderalending.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-12.
MICRO MANUFACTRING was named on the Ransomblog_noname ransomware data-leak (extortion) site on 2025-02-12.
minnesotaexteriors.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-12.
Obex Medical was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-12.
Omni Fiber LLC was named on the Monti ransomware data-leak (extortion) site on 2025-02-12.
rogerspetro.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-12.
slchc.edu was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-12.
Societatea Energetica Electrica S.A. was named on the Lynx ransomware data-leak (extortion) site on 2025-02-12.
steveallcorn.remax.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-12.
STIIIZY Full Data Leak was named on the Everest ransomware data-leak (extortion) site on 2025-02-12.
sundanceliving.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-12.
The Brown & Hurley Group was named on the Lynx ransomware data-leak (extortion) site on 2025-02-12.
thejdkgroup.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-12.
twncomm.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-12.
uniquehd.com\$13.7M\USA\429GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-12.
weathersa.co.za was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-12.
Aurora Public Schools (aurorak12.org) was named on the FOG ransomware data-leak (extortion) site on 2025-02-11.
Baltimore Country Club was named on the Play ransomware data-leak (extortion) site on 2025-02-11.
CESI was named on the Termite ransomware data-leak (extortion) site on 2025-02-11.
Cold Storage Manufacturing was named on the Play ransomware data-leak (extortion) site on 2025-02-11.
EAC Consulting was named on the Play ransomware data-leak (extortion) site on 2025-02-11.
Fastighetsservice AB was named on the Play ransomware data-leak (extortion) site on 2025-02-11.
Hammond Trucking & Excavation was named on the Rhysida ransomware data-leak (extortion) site on 2025-02-11.
Jildor Shoes was named on the Play ransomware data-leak (extortion) site on 2025-02-11.
Kensington Glass Arts was named on the Play ransomware data-leak (extortion) site on 2025-02-11.
Logix Corporate Solutions was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-11.
Mainline Information Systems was named on the Play ransomware data-leak (extortion) site on 2025-02-11.
Monroe Transportation Services Inc was named on the Play ransomware data-leak (extortion) site on 2025-02-11.
Neaton Auto Products Manufacturing was named on the Play ransomware data-leak (extortion) site on 2025-02-11.
primesourcestaffing.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-11.
ROCK SOLID Stabilization & Reclamation was named on the Play ransomware data-leak (extortion) site on 2025-02-11.
Rogers was named on the Hunters International ransomware data-leak (extortion) site on 2025-02-11.
Saint George's College (saintgeorge.cl) was named on the FOG ransomware data-leak (extortion) site on 2025-02-11.
sehma.com was named on the Threeam ransomware data-leak (extortion) site on 2025-02-11.
Shinn Fu Company of America was named on the Play ransomware data-leak (extortion) site on 2025-02-11.
sole technology was named on the Monti ransomware data-leak (extortion) site on 2025-02-11.
The Children's Center Of Hamden was named on the Incransom ransomware data-leak (extortion) site on 2025-02-11.
The University of Notre Dame Australia (nd.edu.au) was named on the FOG ransomware data-leak (extortion) site on 2025-02-11.
Tie Down Engineering was named on the Play ransomware data-leak (extortion) site on 2025-02-11.
TMC was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-11.
abcapital.com.ph was named on the LockBit ransomware data-leak (extortion) site on 2025-02-10.
Albright Institute was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-10.
ASRAM Medical College and Hospita was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-10.
Atlas Commodities was named on the Lynx ransomware data-leak (extortion) site on 2025-02-10.
bazcooil.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-10.
Capital Cell Global (CCG) was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-10.
D-7 Roofing was named on the BianLian ransomware data-leak (extortion) site on 2025-02-10.
Enfin was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-10.
kaplanstahler.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-10.
komline.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-10.
Lexington Electric was named on the Lynx ransomware data-leak (extortion) site on 2025-02-10.
Marshall Motor Holdings was named on the Lynx ransomware data-leak (extortion) site on 2025-02-10.
ome.tv | SOLD was named on the Bashe ransomware data-leak (extortion) site on 2025-02-10.
Recievership Specialists was named on the BianLian ransomware data-leak (extortion) site on 2025-02-10.
sdfab.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-10.
WhoHire was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-10.
www.jsp.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-10.
Gitlabs: Universitatea Politehnica din Bucuresti, Maxvy Technologies Pvt, iRidge Inc. was named on the FOG ransomware data-leak (extortion) site on 2025-02-09.
Handala New Telegram Channel was named on the Handala ransomware data-leak (extortion) site on 2025-02-09.
Hpisd.org was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-09.
Israel Police Hacked was named on the Handala ransomware data-leak (extortion) site on 2025-02-09.
Leading Edge Specialized Dentistry was named on the Rhysida ransomware data-leak (extortion) site on 2025-02-09.
wwcsd.net was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-09.
G*********7.com was named on the Flocker ransomware data-leak (extortion) site on 2025-02-08.
M****s.info was named on the Flocker ransomware data-leak (extortion) site on 2025-02-08.
R******e.tw was named on the Flocker ransomware data-leak (extortion) site on 2025-02-08.
SAKAI SOUKEN Co. was named on the Hunters International ransomware data-leak (extortion) site on 2025-02-08.
Gitlabs: Chalmers tekniska hรถgskola, Fligno, 3SS was named on the FOG ransomware data-leak (extortion) site on 2025-02-07.
sautech.edu was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-07.
teamues.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-07.
Gitlabs: eConceptions, Top Systems, DIEM was named on the FOG ransomware data-leak (extortion) site on 2025-02-06.
northernresponse.com\$17.4M\Canada\366GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-06.
Robertshaw was named on the Hunters International ransomware data-leak (extortion) site on 2025-02-06.
savoiesfoods.com\$18.2M\USA\95GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-06.
SmithDunn&Co was named on the Spacebears ransomware data-leak (extortion) site on 2025-02-06.
zsattorneys.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-06.
A2b-cargo.com was named on the Flocker ransomware data-leak (extortion) site on 2025-02-05.
Banfi Vintners was named on the Lynx ransomware data-leak (extortion) site on 2025-02-05.
corehandf.com was named on the Threeam ransomware data-leak (extortion) site on 2025-02-05.
Dash Business was named on the BianLian ransomware data-leak (extortion) site on 2025-02-05.
Hall Chadwick was named on the BianLian ransomware data-leak (extortion) site on 2025-02-05.
India car owners was named on the Bashe ransomware data-leak (extortion) site on 2025-02-05.
Mid-State Machine & Fabricating Corp was named on the Play ransomware data-leak (extortion) site on 2025-02-05.
NESCTC Security Services was named on the BianLian ransomware data-leak (extortion) site on 2025-02-05.
OFW Law was named on the BianLian ransomware data-leak (extortion) site on 2025-02-05.
Shinsung Delta Tech was named on the Lynx ransomware data-leak (extortion) site on 2025-02-05.
St Clair Orthopaedics and Sports Medicine P.C. was named on the BianLian ransomware data-leak (extortion) site on 2025-02-05.
Toshapp.com was named on the Flocker ransomware data-leak (extortion) site on 2025-02-05.
alojaimi.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-04.
C and R Molds Inc was named on the BianLian ransomware data-leak (extortion) site on 2025-02-04.
C2S Technologies Inc. was named on the Everest ransomware data-leak (extortion) site on 2025-02-04.
capstoneins.ca was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-04.
Casper's Truck Equipment was named on the Kairos ransomware data-leak (extortion) site on 2025-02-04.
clarkfreightways.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-04.
coel.com.mx was named on the Bashe ransomware data-leak (extortion) site on 2025-02-04.
Commercial Solutions was named on the BianLian ransomware data-leak (extortion) site on 2025-02-04.
cornwelltools.com\$218.7M\USA\4.6TB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-04.
escada.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-04.
gaheritagefcu.org was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-04.
Gitlabs: hemio.de, SOLEIL, Devlion was named on the FOG ransomware data-leak (extortion) site on 2025-02-04.
heartlandrvs.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-04.
ITSS was named on the Everest ransomware data-leak (extortion) site on 2025-02-04.
Medical Reports was named on the Kairos ransomware data-leak (extortion) site on 2025-02-04.
mgainnovation.com\$30.9M\USA\215GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-04.
mistralsolutions.com was named on the Bashe ransomware data-leak (extortion) site on 2025-02-04.
rashtiandrashti.com\$19.1M\USA\786GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-02-04.
sportadmin.se was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-04.
Town Counsel Law & Litigation was named on the Rhysida ransomware data-leak (extortion) site on 2025-02-04.
www.aswgr.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-04.
www.aymcdonald.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-04.
Daniel Island Club was named on the Play ransomware data-leak (extortion) site on 2025-02-03.
Dickerson & Nieman Realtors was named on the Play ransomware data-leak (extortion) site on 2025-02-03.
DPC Development was named on the Play ransomware data-leak (extortion) site on 2025-02-03.
[EVIDANCE] AIshu, Eshoo was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-02-03.
Evidn Data Leak was named on the Everest ransomware data-leak (extortion) site on 2025-02-03.
Gitlabs: Bolin Centre for Climate Research, X-lab group, Madia was named on the FOG ransomware data-leak (extortion) site on 2025-02-03.
gruppozaccaria.it was named on the LockBit ransomware data-leak (extortion) site on 2025-02-03.
Karadeniz Holding (karadenizholding.com) was named on the FOG ransomware data-leak (extortion) site on 2025-02-03.
KWS was named on the Play ransomware data-leak (extortion) site on 2025-02-03.
ome.tv was named on the Bashe ransomware data-leak (extortion) site on 2025-02-03.
Pineland community service board was named on the Spacebears ransomware data-leak (extortion) site on 2025-02-03.
Ponte16 Hotel & was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-03.
QGS Development was named on the Play ransomware data-leak (extortion) site on 2025-02-03.
realtaxcanada.com was named on the Bashe ransomware data-leak (extortion) site on 2025-02-03.
Sheridan Nurseries was named on the Play ransomware data-leak (extortion) site on 2025-02-03.
smithmidland.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-03.
The Hill Brush was named on the Play ransomware data-leak (extortion) site on 2025-02-03.
Woodway USA was named on the Play ransomware data-leak (extortion) site on 2025-02-03.
www.origene.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-03.
www.wongfleming.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-02-03.
Ayres Law Firm was named on the BianLian ransomware data-leak (extortion) site on 2025-02-02.
Civic Committee was named on the BianLian ransomware data-leak (extortion) site on 2025-02-02.
Four Eye Clinics was named on the Abyss ransomware data-leak (extortion) site on 2025-02-02.
Growth Acceleration Partners was named on the BianLian ransomware data-leak (extortion) site on 2025-02-02.
jpcgroupinc.com was named on the Abyss ransomware data-leak (extortion) site on 2025-02-02.
Tosaf Hacked was named on the Handala ransomware data-leak (extortion) site on 2025-02-02.
usuhs.edu was named on the LockBit ransomware data-leak (extortion) site on 2025-02-02.
CAMRIDGEPORT was named on the Spacebears ransomware data-leak (extortion) site on 2025-02-01.
Eascon was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-02-01.
Falcon Gaming was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-02-01.
GATTELLI SpA was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-02-01.
Gitlabs: PT. ITPRENEUR INDONESIA TECHNOLOGY, GFZ Helmholtz Centre for Geosciences, LUA Cof was named on the FOG ransomware data-leak (extortion) site on 2025-02-01.
My New Jersey Dentist was named on the Rhysida ransomware data-leak (extortion) site on 2025-02-01.
Nano Health was named on the Killsecurity ransomware data-leak (extortion) site on 2025-02-01.
Technico was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-02-01.
Utilissimo Transportes was named on the Arcusmedia ransomware data-leak (extortion) site on 2025-02-01.
Wireless Solutions (Morris.Domain) was named on the Lynx ransomware data-leak (extortion) site on 2025-02-01.
Zamzow's was named on the Lynx ransomware data-leak (extortion) site on 2025-02-01.
A**-****o.com was named on the Flocker ransomware data-leak (extortion) site on 2025-01-31.
BH Aircraft Company, Inc. was named on the Rhysida ransomware data-leak (extortion) site on 2025-01-31.
Pembina Trails School Division was named on the Rhysida ransomware data-leak (extortion) site on 2025-01-31.
T*****p.com was named on the Flocker ransomware data-leak (extortion) site on 2025-01-31.
Engine Power Source was named on the Lynx ransomware data-leak (extortion) site on 2025-01-30.
FENSTERMAKER was named on the Monti ransomware data-leak (extortion) site on 2025-01-30.
Gitlabs: Prasaga, HE2B, Kombinat was named on the FOG ransomware data-leak (extortion) site on 2025-01-30.
Gitlabs: Professional Computer, X-Pans, Propulsion Academy AG was named on the FOG ransomware data-leak (extortion) site on 2025-01-30.
ibericar was named on the Monti ransomware data-leak (extortion) site on 2025-01-30.
icicibank.com | SOLD was named on the Bashe ransomware data-leak (extortion) site on 2025-01-30.
Jalaram Produce was named on the Lynx ransomware data-leak (extortion) site on 2025-01-30.
jayaapparelgroup.com\$60.6M\USA\824GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-01-30.
johnpaulrichard.com\$60M\USA\985GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-01-30.
KPI Engineering was named on the Lynx ransomware data-leak (extortion) site on 2025-01-30.
malindoair.com | SOLD was named on the Bashe ransomware data-leak (extortion) site on 2025-01-30.
nenok.de was named on the Monti ransomware data-leak (extortion) site on 2025-01-30.
Night Hawk was named on the Play ransomware data-leak (extortion) site on 2025-01-30.
payahmedabadechallan.org was named on the Killsecurity ransomware data-leak (extortion) site on 2025-01-30.
Scott Engineering was named on the Lynx ransomware data-leak (extortion) site on 2025-01-30.
Silverado Contractors was named on the Lynx ransomware data-leak (extortion) site on 2025-01-30.
soitinlaine.fi was named on the Threeam ransomware data-leak (extortion) site on 2025-01-30.
sunrise-soya.com\$42.2M\Canada\504GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-01-30.
Tri-Sen Systems was named on the Lynx ransomware data-leak (extortion) site on 2025-01-30.
ttucorp.com\$27.6M\USA\1TB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-01-30.
vsstransportationgroup.com\$54.5M\USA\522GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-01-30.
Zschimmer and Schwarz was named on the Termite ransomware data-leak (extortion) site on 2025-01-30.
air europa was named on the Incransom ransomware data-leak (extortion) site on 2025-01-29.
alkodistributors.com\$33.5M\USA\345GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-01-29.
biagibros.com\$273M\USA\820GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-01-29.
Boldon James was named on the Incransom ransomware data-leak (extortion) site on 2025-01-29.
Boutin Jones (boutindentino.com) was named on the FOG ransomware data-leak (extortion) site on 2025-01-29.
By design was named on the Play ransomware data-leak (extortion) site on 2025-01-29.
Cahoon Farms was named on the Play ransomware data-leak (extortion) site on 2025-01-29.
Cimarron Telephone Company was named on the Play ransomware data-leak (extortion) site on 2025-01-29.
City Of Beloit was named on the Incransom ransomware data-leak (extortion) site on 2025-01-29.
Commercial & Residential Management Group was named on the Play ransomware data-leak (extortion) site on 2025-01-29.
daVinci was named on the Play ransomware data-leak (extortion) site on 2025-01-29.
DEL Packaging was named on the Kairos ransomware data-leak (extortion) site on 2025-01-29.
Delta Screen & Filtration () was named on the Lynx ransomware data-leak (extortion) site on 2025-01-29.
Heart to Heart Hospice was named on the Incransom ransomware data-leak (extortion) site on 2025-01-29.
Israel Ministry of National Security Hacked was named on the Handala ransomware data-leak (extortion) site on 2025-01-29.
Johnston was named on the Play ransomware data-leak (extortion) site on 2025-01-29.
Marshall & Bruce Printing was named on the Play ransomware data-leak (extortion) site on 2025-01-29.
Menominee Tribal Clinic was named on the Incransom ransomware data-leak (extortion) site on 2025-01-29.
midwaymetals.com.vn was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-29.
Mission Locale Montpellier was named on the Incransom ransomware data-leak (extortion) site on 2025-01-29.
Plymouth Foam was named on the Play ransomware data-leak (extortion) site on 2025-01-29.
Rossi Real Estate (ROSSIDG.LOCAL) was named on the Lynx ransomware data-leak (extortion) site on 2025-01-29.
SCV Med Group was named on the Monti ransomware data-leak (extortion) site on 2025-01-29.
Strategic Materials was named on the Lynx ransomware data-leak (extortion) site on 2025-01-29.
The Wendt Agency was named on the Lynx ransomware data-leak (extortion) site on 2025-01-29.
tnlottery.com was named on the Incransom ransomware data-leak (extortion) site on 2025-01-29.
TRIVAD was named on the Play ransomware data-leak (extortion) site on 2025-01-29.
Turning Leaf (TURNINGLEAF.local) was named on the Incransom ransomware data-leak (extortion) site on 2025-01-29.
W*****e.com was named on the Flocker ransomware data-leak (extortion) site on 2025-01-29.
Wallin & Klarich was named on the Play ransomware data-leak (extortion) site on 2025-01-29.
Acoustiblok was named on the Monti ransomware data-leak (extortion) site on 2025-01-28.
BBLAWFIRM was named on the Monti ransomware data-leak (extortion) site on 2025-01-28.
broward.edu was named on the Incransom ransomware data-leak (extortion) site on 2025-01-28.
Carthage Police Department was named on the Rhysida ransomware data-leak (extortion) site on 2025-01-28.
cnnindonesia.com was named on the Incransom ransomware data-leak (extortion) site on 2025-01-28.
lnetwork was named on the Monti ransomware data-leak (extortion) site on 2025-01-28.
metalurgica roma was named on the Monti ransomware data-leak (extortion) site on 2025-01-28.
sce.org.sg was named on the Lynx ransomware data-leak (extortion) site on 2025-01-28.
www.healthcarewithinreach.org was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-28.
AIshu, Eshoo was named on the Ransomhouse ransomware data-leak (extortion) site on 2025-01-27.
Alo Center (hq.aloteknik.se) was named on the Lynx ransomware data-leak (extortion) site on 2025-01-27.
https://leehartman.com was named on the Metaencryptor ransomware data-leak (extortion) site on 2025-01-27.
International AIDS Vaccine Initiative (iavi.org) was named on the Incransom ransomware data-leak (extortion) site on 2025-01-27.
lhps.org was named on the Incransom ransomware data-leak (extortion) site on 2025-01-27.
Prinston Pharmaceutical (huahaius.com) was named on the Incransom ransomware data-leak (extortion) site on 2025-01-27.
Weeks, Brucker & Coleman, Ltd | Legal Services was named on the Everest ransomware data-leak (extortion) site on 2025-01-27.
Letโs Secure Insurance was named on the Killsecurity ransomware data-leak (extortion) site on 2025-01-26.
Metro Wire & Cable was named on the Spacebears ransomware data-leak (extortion) site on 2025-01-26.
DataSociete was named on the Killsecurity ransomware data-leak (extortion) site on 2025-01-25.
envirosep.com was named on the Abyss ransomware data-leak (extortion) site on 2025-01-25.
Keepz was named on the Killsecurity ransomware data-leak (extortion) site on 2025-01-25.
Arrow Motor Auctions was named on the Spacebears ransomware data-leak (extortion) site on 2025-01-24.
De La Salle High School (dlshs.org) was named on the FOG ransomware data-leak (extortion) site on 2025-01-24.
ELTEK Group (eltekgroup.com) was named on the FOG ransomware data-leak (extortion) site on 2025-01-24.
icicibank.com was named on the Bashe ransomware data-leak (extortion) site on 2025-01-24.
Kooijman Vianen (kooijmanvianen.nl) was named on the FOG ransomware data-leak (extortion) site on 2025-01-24.
ORU Mabee Center was named on the Rhysida ransomware data-leak (extortion) site on 2025-01-24.
PrimoTicketing was named on the Killsecurity ransomware data-leak (extortion) site on 2025-01-24.
Punjab.gov.pk was named on the Flocker ransomware data-leak (extortion) site on 2025-01-24.
topackt.com was named on the LockBit ransomware data-leak (extortion) site on 2025-01-24.
www.pcm.com.mx was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-24.
archaeologicalresearchservices.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-23.
Cyrious Software was named on the BianLian ransomware data-leak (extortion) site on 2025-01-23.
Medical Associates of Brevard was named on the BianLian ransomware data-leak (extortion) site on 2025-01-23.
PINELAND BHDD COMMUNITY SERVICES was named on the Spacebears ransomware data-leak (extortion) site on 2025-01-23.
reesndt.ca was named on the Eldorado ransomware data-leak (extortion) site on 2025-01-23.
samsill.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-23.
starkaerospace.com was named on the Incransom ransomware data-leak (extortion) site on 2025-01-23.
www.missionbank.bank was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-23.
Christian Community Aid was named on the Spacebears ransomware data-leak (extortion) site on 2025-01-22.
Gossett Motor Cars was named on the Lynx ransomware data-leak (extortion) site on 2025-01-22.
ilemgroup.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-22.
Jacobs & Thompson was named on the Lynx ransomware data-leak (extortion) site on 2025-01-22.
Mintz Law Firm, LLC was named on the Lynx ransomware data-leak (extortion) site on 2025-01-22.
Omni Fiber LLC - Press Release was named on the Monti ransomware data-leak (extortion) site on 2025-01-22.
SANTA MARIA LABORATORIO was named on the Spacebears ransomware data-leak (extortion) site on 2025-01-22.
sdkgroup.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-22.
www.americanstandard-us.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-22.
www.grohe.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-22.
www.manpower.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-22.
www.reesndt.com was named on the Eldorado ransomware data-leak (extortion) site on 2025-01-22.
Bethany Hospital was named on the Spacebears ransomware data-leak (extortion) site on 2025-01-21.
boardman-hamilton.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-21.
FAAB Invest Advisors Private Limited was named on the Killsecurity ransomware data-leak (extortion) site on 2025-01-21.
Inaya Clinique was named on the Spacebears ransomware data-leak (extortion) site on 2025-01-21.
malindoair.com was named on the Bashe ransomware data-leak (extortion) site on 2025-01-21.
Marukai was named on the Lynx ransomware data-leak (extortion) site on 2025-01-21.
miedemaproduce.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-21.
Nimbus Facility Services was named on the Killsecurity ransomware data-leak (extortion) site on 2025-01-21.
precisionmechsd.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-21.
RETAL Baltic Films was named on the Incransom ransomware data-leak (extortion) site on 2025-01-21.
Solaris-pharma.com leakage was named on the Everest ransomware data-leak (extortion) site on 2025-01-21.
supremegroup.co.in was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-21.
whychoosebw.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-21.
Angotti & Reilly was named on the Lynx ransomware data-leak (extortion) site on 2025-01-20.
Clutch Industries was named on the Lynx ransomware data-leak (extortion) site on 2025-01-20.
fol-23.fr was named on the Bashe ransomware data-leak (extortion) site on 2025-01-20.
Kinseth Hospitality Companies was named on the Lynx ransomware data-leak (extortion) site on 2025-01-20.
P****b.gov.pk was named on the Flocker ransomware data-leak (extortion) site on 2025-01-20.
PetroVietnam Exploration Production Corporation was named on the Hunters International ransomware data-leak (extortion) site on 2025-01-20.
Sentinel Systems was named on the Lynx ransomware data-leak (extortion) site on 2025-01-20.
The Urswick School was named on the Kairos ransomware data-leak (extortion) site on 2025-01-20.
Zuk Group Hacked was named on the Handala ransomware data-leak (extortion) site on 2025-01-20.
TG3 Electronics was named on the Rhysida ransomware data-leak (extortion) site on 2025-01-19.
Kassin & Carrow was named on the Lynx ransomware data-leak (extortion) site on 2025-01-18.
Marina Family Medical was named on the Moneymessage ransomware data-leak (extortion) site on 2025-01-18.
MassDevelopment was named on the BianLian ransomware data-leak (extortion) site on 2025-01-18.
betclic.com was named on the Bashe ransomware data-leak (extortion) site on 2025-01-17.
Kilgore College (kilgore.edu) was named on the Incransom ransomware data-leak (extortion) site on 2025-01-17.
Nightingale Hammerson was named on the Kairos ransomware data-leak (extortion) site on 2025-01-17.
peponline.org was named on the Incransom ransomware data-leak (extortion) site on 2025-01-17.
Regina Coeli Convent was named on the Incransom ransomware data-leak (extortion) site on 2025-01-17.
Taylor Regional Hospital (thcg.local) was named on the Incransom ransomware data-leak (extortion) site on 2025-01-17.
Washington Gastroenterology (DHSWA.NET) was named on the Incransom ransomware data-leak (extortion) site on 2025-01-17.
Access Capital Partners SA was named on the Lynx ransomware data-leak (extortion) site on 2025-01-16.
anupalanonline.com was named on the Killsecurity ransomware data-leak (extortion) site on 2025-01-16.
bsegroup.it was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-16.
Fish Nelson and Holden was named on the BianLian ransomware data-leak (extortion) site on 2025-01-16.
Real Tax was named on the Kairos ransomware data-leak (extortion) site on 2025-01-16.
Solaris Pharma proof was named on the Everest ransomware data-leak (extortion) site on 2025-01-16.
The Hoff Brand SL was named on the Everest ransomware data-leak (extortion) site on 2025-01-16.
Volt Infrastructure was named on the Everest ransomware data-leak (extortion) site on 2025-01-16.
Woodlake was named on the Everest ransomware data-leak (extortion) site on 2025-01-16.
www.liteputer.com.tw was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-16.
www.solariumrevestimentos.com.br was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-16.
A*****Y.com was named on the Flocker ransomware data-leak (extortion) site on 2025-01-15.
AKConstructors.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-15.
anwsd.org was named on the Threeam ransomware data-leak (extortion) site on 2025-01-15.
Combined Pool and Spa was named on the Kairos ransomware data-leak (extortion) site on 2025-01-15.
communisis.com & paragon.world was named on the Lynx ransomware data-leak (extortion) site on 2025-01-15.
fplfood.com\$675M\USA\21GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-01-15.
FSOCIETY X FUNKSEC was named on the Flocker ransomware data-leak (extortion) site on 2025-01-15.
J.G. Electrical Installations was named on the Kairos ransomware data-leak (extortion) site on 2025-01-15.
Lowe Engineers was named on the Lynx ransomware data-leak (extortion) site on 2025-01-15.
optiline.com\$127.3M\USA\947GB\<1% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-01-15.
pnp.co.za was named on the Bashe ransomware data-leak (extortion) site on 2025-01-15.
Woodport Doors was named on the Lynx ransomware data-leak (extortion) site on 2025-01-15.
www.eurocert.pl was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-15.
Buttery (butterycompany.com) was named on the FOG ransomware data-leak (extortion) site on 2025-01-14.
Douglas County, GA (DDCWSA.COM) was named on the Lynx ransomware data-leak (extortion) site on 2025-01-14.
Farmacia Cofar was named on the Killsecurity ransomware data-leak (extortion) site on 2025-01-14.
Intelservice.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-14.
pittman-construction.com was named on the LockBit ransomware data-leak (extortion) site on 2025-01-14.
QualiTech (qualitech.com) was named on the Lynx ransomware data-leak (extortion) site on 2025-01-14.
SciTech Services, Inc. was named on the FOG ransomware data-leak (extortion) site on 2025-01-14.
Sharm Reef Hotel was named on the Spacebears ransomware data-leak (extortion) site on 2025-01-14.
Solaris Pharma was named on the Everest ransomware data-leak (extortion) site on 2025-01-14.
Spectrum was named on the Incransom ransomware data-leak (extortion) site on 2025-01-14.
The Chicano Federation was named on the Rhysida ransomware data-leak (extortion) site on 2025-01-14.
The University of Oklahoma (ou.edu) was named on the FOG ransomware data-leak (extortion) site on 2025-01-14.
udb.net was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-14.
WPD.WOODPORTDOORS.COM was named on the Lynx ransomware data-leak (extortion) site on 2025-01-14.
adveo.com\$740.7M\France\1.1TB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-01-13.
atpformosa.gob.ar was named on the LockBit ransomware data-leak (extortion) site on 2025-01-13.
Biomedical Caledonia Medical Laboratory (calmedlab.local) was named on the Incransom ransomware data-leak (extortion) site on 2025-01-13.
Browdy (bl.local) was named on the Lynx ransomware data-leak (extortion) site on 2025-01-13.
candelasyasociados.es was named on the LockBit ransomware data-leak (extortion) site on 2025-01-13.
Conad (conad.lan) was named on the Lynx ransomware data-leak (extortion) site on 2025-01-13.
Delap & Waller was named on the Lynx ransomware data-leak (extortion) site on 2025-01-13.
Findhelp Information Services was named on the Incransom ransomware data-leak (extortion) site on 2025-01-13.
gelco-s-a.com.br was named on the LockBit ransomware data-leak (extortion) site on 2025-01-13.
healthcarewithinreach.org was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-13.
Imperial Valley Respite (ivrespite.com) was named on the Incransom ransomware data-leak (extortion) site on 2025-01-13.
lamejor.com.co was named on the LockBit ransomware data-leak (extortion) site on 2025-01-13.
mi.edu was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-13.
Nash Brothers Construction (nashdom.local) was named on the Lynx ransomware data-leak (extortion) site on 2025-01-13.
nicatel.com.uy was named on the LockBit ransomware data-leak (extortion) site on 2025-01-13.
Novati Constructions was named on the Lynx ransomware data-leak (extortion) site on 2025-01-13.
Onecare was named on the Incransom ransomware data-leak (extortion) site on 2025-01-13.
oyolasvegas.com was named on the LockBit ransomware data-leak (extortion) site on 2025-01-13.
PHG CPAs (bushman.biz) was named on the Lynx ransomware data-leak (extortion) site on 2025-01-13.
Riverina Medical was named on the Incransom ransomware data-leak (extortion) site on 2025-01-13.
SERGAS Group was named on the Lynx ransomware data-leak (extortion) site on 2025-01-13.
telering.de was named on the LockBit ransomware data-leak (extortion) site on 2025-01-13.
viacaojacarei.com.br was named on the LockBit ransomware data-leak (extortion) site on 2025-01-13.
Welcomehallmission.com was named on the Everest ransomware data-leak (extortion) site on 2025-01-13.
Arun Estates was named on the Black Basta ransomware data-leak (extortion) site on 2025-01-11.
Astaphans was named on the Lynx ransomware data-leak (extortion) site on 2025-01-11.
Avril Supermarchรฉ Santรฉ was named on the Black Basta ransomware data-leak (extortion) site on 2025-01-11.
Barber Specialties was named on the Hunters International ransomware data-leak (extortion) site on 2025-01-11.
Bnext.nl was named on the Black Basta ransomware data-leak (extortion) site on 2025-01-11.
Brachot was named on the Black Basta ransomware data-leak (extortion) site on 2025-01-11.
COROB was named on the Hunters International ransomware data-leak (extortion) site on 2025-01-11.
Costex was named on the Hunters International ransomware data-leak (extortion) site on 2025-01-11.
Granby Industries was named on the Black Basta ransomware data-leak (extortion) site on 2025-01-11.
Jim Thompson was named on the Lynx ransomware data-leak (extortion) site on 2025-01-11.
Mortgage Investors Group (MIG) was named on the Black Basta ransomware data-leak (extortion) site on 2025-01-11.
Patriarche Office of Architecture was named on the Hunters International ransomware data-leak (extortion) site on 2025-01-11.
Plasma-Therm was named on the Black Basta ransomware data-leak (extortion) site on 2025-01-11.
RocSearch was named on the Hunters International ransomware data-leak (extortion) site on 2025-01-11.
Schuff Steel Company was named on the Black Basta ransomware data-leak (extortion) site on 2025-01-11.
T. Hasegawa USA was named on the Hunters International ransomware data-leak (extortion) site on 2025-01-11.
Unisource Information Services was named on the Hunters International ransomware data-leak (extortion) site on 2025-01-11.
amerplumb.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-10.
Evidn was named on the Everest ransomware data-leak (extortion) site on 2025-01-10.
massdevelopment.com\$24.6M\USA\1.2TB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-01-10.
OmniRide (omniride.com) was named on the FOG ransomware data-leak (extortion) site on 2025-01-10.
Protected: Title Hidden was named on the Everest ransomware data-leak (extortion) site on 2025-01-10.
ptcky.com\$5M\USA\902GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-01-10.
Qualinet was named on the Rhysida ransomware data-leak (extortion) site on 2025-01-10.
www.wisesocon.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-10.
xtremmedia.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-10.
alansarioman.com was named on the Embargo ransomware data-leak (extortion) site on 2025-01-09.
awimc.com\$102.7M\USA\440GB\100% DISCLOSED was named on the Cactus ransomware data-leak (extortion) site on 2025-01-09.
azpay.me | SOLD was named on the Bashe ransomware data-leak (extortion) site on 2025-01-09.
castlehillha.co.uk was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-09.
CO-VER Power Technology SpA Data Leak was named on the Everest ransomware data-leak (extortion) site on 2025-01-09.
depewgillen.com was named on the Incransom ransomware data-leak (extortion) site on 2025-01-09.
drive-lines.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-09.
evasair.com was named on the Eldorado ransomware data-leak (extortion) site on 2025-01-09.
Fukoku Co. Ltd. was named on the Spacebears ransomware data-leak (extortion) site on 2025-01-09.
hapsch.de was named on the Threeam ransomware data-leak (extortion) site on 2025-01-09.
Izmocars Data Leak was named on the Everest ransomware data-leak (extortion) site on 2025-01-09.
Myhealthcarebilling Data Leak was named on the Everest ransomware data-leak (extortion) site on 2025-01-09.
Sarah Car Care Data Leak was named on the Everest ransomware data-leak (extortion) site on 2025-01-09.
www.excelresourcing.co.uk was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-09.
www.fairhallzhang.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-09.
www.leaguecenter.org was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-09.
www.mie.com.my was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-09.
www.primalwear.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-09.
www.rotaryeng.co.th was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-09.
www.temotekstil.com.tr was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-09.
acquafertil.com.br was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-08.
bendixengineering was named on the Ransomblog_noname ransomware data-leak (extortion) site on 2025-01-08.
fwmep.edu was named on the Incransom ransomware data-leak (extortion) site on 2025-01-08.
General Digital was named on the Spacebears ransomware data-leak (extortion) site on 2025-01-08.
General Digital CRM was named on the Spacebears ransomware data-leak (extortion) site on 2025-01-08.
Huntington Hotel Group was named on the Termite ransomware data-leak (extortion) site on 2025-01-08.
kingpower.com was named on the Abyss ransomware data-leak (extortion) site on 2025-01-08.
sahpetrol.com.tr was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-08.
astaphans.com was named on the Lynx ransomware data-leak (extortion) site on 2025-01-07.
jimthompson.com was named on the Lynx ransomware data-leak (extortion) site on 2025-01-07.
Saint-Bar (saintbar.be) was named on the FOG ransomware data-leak (extortion) site on 2025-01-07.
Sunflower Medical Group was named on the Rhysida ransomware data-leak (extortion) site on 2025-01-07.
u0 Excel Transportation was named on the Lynx ransomware data-leak (extortion) site on 2025-01-07.
molars.co.ke was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-06.
yoniot.cn was named on the Darkvault ransomware data-leak (extortion) site on 2025-01-06.
akantha.fr was named on the Eldorado ransomware data-leak (extortion) site on 2025-01-05.
Car Care Plan - Turkey was named on the Hellcat ransomware data-leak (extortion) site on 2025-01-05.
Hunter Taubman Fischer & Li was named on the Lynx ransomware data-leak (extortion) site on 2025-01-05.
aliorbank.pl was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
assurified.com was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
baldinger-ag.ch was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
bigalsfoodservice.co.uk was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
bms.com was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
certifiedinfosec.com was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
credio.eu was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
datascan.com was named on the Eldorado ransomware data-leak (extortion) site on 2025-01-04.
fpj.com.py PART1 was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
fpj.com.py PART2 was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
fpj.com.py PART3 was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
gannons.co.uk was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
hasa-arg.com was named on the Eldorado ransomware data-leak (extortion) site on 2025-01-04.
lamaisonducitron.com was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
legilog.fr was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
minerasancristobal.com was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
Montreal North was named on the Rhysida ransomware data-leak (extortion) site on 2025-01-04.
netromsoftware.ro was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
northernsafety.com was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
perucontrols.com was named on the Eldorado ransomware data-leak (extortion) site on 2025-01-04.
pindrophearing.co.uk was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
polleninformation.at was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
prixet.com was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
protectasecurity.pe was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
sansirostadium.com was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
scopeset.de was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
sella.eng.br was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
servicepower.com was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
sfr.fr was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
siapenet.gov.br was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
talonsolutions.co.uk was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
trifecta.com was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
trinitesolutions.com was named on the Bashe ransomware data-leak (extortion) site on 2025-01-04.
Amourgis & Associates was named on the Lynx ransomware data-leak (extortion) site on 2025-01-03.
Nikki-Universal Co Ltd was named on the Hunters International ransomware data-leak (extortion) site on 2025-01-03.
www.alliancemat.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-03.
www.geedingconstruction.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-03.
confluxhr.com was named on the Darkvault ransomware data-leak (extortion) site on 2025-01-02.
groupegm.com was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-02.
CM Buck & Associates was named on the Lynx ransomware data-leak (extortion) site on 2025-01-01.
http://www.kitevuc.com was named on the Ciphbit ransomware data-leak (extortion) site on 2025-01-01.
lianbeng.sg was named on the RansomHub ransomware data-leak (extortion) site on 2025-01-01.
regencymedia was named on the LockBit ransomware data-leak (extortion) site on 2025-01-01.
On 31 December 2024, the DragonForce ransomware gang listed Cogitis โ a French inter-municipal IT syndicate serving local authorities โ on its leak site, claiming around 81 GB of exfiltrated data including internal files and personal data tied to the public bodies it supports.
On 28 December 2024, the Space Bears ransomware group claimed to have compromised an Atos database; the French IT giant investigated and concluded its own systems were not breached, attributing the leaked Atos-related data to a compromised external third-party infrastructure.
A ransomware attack disclosed in late December 2024 crippled Arsoรฉ de Soual, the agricultural IT provider hosting livestock-management software for ~30,000 farmers across some 22 French departments; systems were encrypted and a ransom demanded, with no data exfiltration detected.
In December 2024, the ransomware-as-a-service group Cicada 3301 claimed to have stolen 40 GB of data from Peugeot dealerships (mainly in Lot-et-Garonne, France), including customer ID documents, VINs and vehicle inventory data, threatening to publish it by 6 January 2025.
The Lynx ransomware gang breached Electrica Group, one of Romania's largest electricity suppliers serving 3.8 million users, disrupting customer-facing services while SCADA and other critical grid systems were isolated and kept running.
On 4 December 2024, the Brain Cipher ransomware group publicly claimed to have stolen over 1 TB of data from Deloitte UK; Deloitte said the allegations related to a single client's system outside its own network and that no Deloitte systems were impacted.
RansomHub ransomware forced Costa Rica's state oil refiner RECOPE to switch its entire fuel-distribution network to manual operations, triggering the first real-world deployment of the U.S. State Department's FALCON cyber-response program.
In November 2024, the Chambres d'agriculture d'Occitanie โ France's regional public chambers of agriculture โ were hit by a malware/ransomware-type cyberattack that spread across their interconnected national network and rendered the workstations of roughly 1,000 regional staff unusable.
RansomHub gained access to Halliburton's systems, prompting the oil-services giant to take infrastructure offline. The incident delayed invoicing and purchase orders, and Halliburton booked a $35 million loss in its SEC filings.
The Brain Cipher ransomware group encrypted Indonesia's Temporary National Data Centre (PDNS 2), disrupting 282 government services across more than 200 agencies and demanding an $8 million ransom the government refused to pay.
BlackSuit operators encrypted CDK Global's dealer-management platform, knocking ~15,000 North American car dealerships offline for nearly two weeks. A second attack hit on day two of recovery. Industry losses estimated at over $1 billion; CDK reportedly paid a $25 million ransom.
Phishing access let BlackSuit (Russian-linked) encrypt KADOKAWA's infrastructure and the Niconico video-sharing platform, taking services offline for two months. KADOKAWA paid ~$2.9M in cryptocurrency โ and BlackSuit leaked the stolen 1.5 TB anyway.
A ransomware attack on Australian e-prescription provider MediSecure exposed the personal and health data of roughly 12.9 million Australians โ one of the country's largest breaches โ and pushed the company into administration and liquidation.
Black Basta ransomware crippled Ascension, one of the largest U.S. health systems, after an employee downloaded a malicious file. The attack forced 140 hospitals onto manual operations for weeks, diverted ambulances, and ultimately exposed the data of nearly 5.6 million patients.
ALPHV/BlackCat compromised Change Healthcare via Citrix portal lacking MFA, paralyzed U.S. prescription claims for weeks, and exfiltrated data on an estimated 100 million people.
A Backmydata (Phobos-family) ransomware attack on the shared Hipocrate hospital information system encrypted data at 25 Romanian hospitals and forced about 75 more offline, pushing more than 100 facilities back to paper records.
Cactus ransomware operators hit Schneider Electric's Sustainability Business division, taking the Resource Advisor consulting platform offline and exfiltrating approximately 1.5 TB of data โ including passport scans and signed NDAs from customers like Hilton, PepsiCo, and Walmart.
LockBit 3.0 encrypted the data centres of Italian cloud provider Westpole, taking down PA Digitale's Urbi platform โ which serves 1,300 Italian public administrations including 540 municipalities, the Quirinale presidency, ISTAT, the Bank of Italy, and the Ministry of Environment. Payroll, citizen services, and local-government workflows were degraded for weeks.
The RA World ransomware gang breached Poland's nationwide ALAB Laboratoria medical-lab network, stealing patient test results and PESEL identity numbers. ALAB refused to pay, and the criminals published sensitive medical data on tens of thousands of patients in what became Poland's largest medical data breach.
LockBit ransomware disrupted the U.S. broker-dealer arm of the world's largest bank, ICBC, jamming settlement of over $9 billion in U.S. Treasury trades. Bank staff sent critical settlement details by USB stick via a messenger across Manhattan. $62 billion of Treasuries failed to deliver in one day.
Rhysida ransomware operators destroyed servers, demanded ~ยฃ600,000, and leaked 600 GB of internal data when the British Library refused to pay. The main catalogue did not return online โ read-only โ until January 2024. Recovery is consuming 40% of the Library's financial reserves.
LockBit operators exploited the Citrix Bleed vulnerability (CVE-2023-4966) to enter Boeing's parts and distribution business. Boeing did not pay; LockBit leaked roughly 45 GB of data, including Citrix logs, email backups, supplier lists, and 2020 pricing data.
The Medusa ransomware gang breached the Philippine Health Insurance Corporation, exfiltrating around 750 GB of sensitive member and medical data and demanding a $300,000 ransom; the government refused to pay and the data was leaked.
A ransomware attack crippled roughly 80% of the Hong Kong Consumer Council's computer systems, with attackers exfiltrating about 65GB of data and demanding a US$500,000 ransom that the watchdog refused to pay.
A ransomware attack on regional cloud provider IFX Networks cascaded into more than 50 Colombian state and private entities โ including the Ministry of Health, the Judiciary, and the Superintendency of Industry and Commerce โ and affected 762 organisations across Latin America.
A ransomware attack on Sri Lanka's Lanka Government Cloud encrypted around 5,000 gov.lk email accounts โ including the Cabinet Office โ and, because backups were also encrypted, permanently destroyed roughly three months of government email.
Scattered Spider vished an MGM IT-desk agent, gained Okta admin, and let ALPHV detonate ransomware. Casinos went offline for ten days; the loss to MGM exceeded $100 million.
Scattered Spider impersonated a Caesars employee on a call to a third-party IT support vendor and convinced the vendor to grant Okta credentials, then exfiltrated customer loyalty data including SSNs and driver's licences. Caesars paid roughly $15 million ransom; the FBI later froze a substantial portion of the funds with Chainalysis assistance.
The Play ransomware gang breached Swiss IT supplier Xplain and leaked around 65,000 documents on the darknet, including sensitive Federal Administration files from the justice, police, and defence departments.
Play ransomware breached Swiss IT services provider Xplain, exfiltrating 1.3 million files. Approximately 65,000 documents belonging to the Swiss Federal Administration โ including classified content, personal data, and readable passwords โ were published on Play's dark-web leak site in June 2023.
The LockBit ransomware gang crippled Indonesia's largest Islamic bank for days, then leaked 1.5 TB of data covering some 15 million customers and employees after a $20 million ransom went unpaid.
A Black Basta ransomware intrusion into UK outsourcing giant Capita exposed pension and personal data on roughly 6.6 million people, drew a ยฃ14 million ICO fine, and cost the company over ยฃ25 million.
LockBit affiliates encrypted Canada's largest bookseller, taking the website and in-store payment systems offline for weeks. Indigo publicly refused the ransom; LockBit published employee personal data.
LockBit affiliates encrypted Royal Mail's international export systems, halting all overseas postal services from the U.K. for six weeks. Royal Mail publicly refused the ยฃ65.7M ransom demand; LockBit progressively leaked exfiltrated data.
Toronto's Hospital for Sick Children was hit by a ransomware attack over the December 2022 holidays that delayed lab and imaging results; in a rare move, the LockBit gang apologized, blamed a rogue affiliate, and released a free decryptor.
The BlackCat/ALPHV ransomware gang crippled Colombia's largest public utility, Empresas Pรบblicas de Medellรญn, forcing 4,000 staff to work offline and disrupting electricity, water, and gas billing across 123 municipalities.
The RansomHouse gang struck Colombian healthcare giant Keralty and its EPS Sanitas and Colsanitas subsidiaries, claiming 3 TB of stolen data and crippling appointment scheduling for a network serving more than 6 million patients.
Ransomware encrypted the All India Institute of Medical Sciences in New Delhi โ India's most prestigious public hospital โ taking patient registration and clinical records offline for two weeks during peak winter patient load.
The Daixin Team ransomware gang breached AirAsia, stealing and leaking personal data on roughly 5 million unique passengers and all of the airline's employees, after the carrier reportedly declined to negotiate a ransom.
Russian-speaking attackers exfiltrated full health-claim records on 9.7 million current and former Medibank customers, then released them in tranches on the dark web after the Australian insurer refused to pay.
The Ragnar Locker ransomware gang breached Portugal's flag carrier, exfiltrating and later publishing 581 GB of data on roughly 1.5 million customers, exposing names, dates of birth, addresses and contact details for over 5 million email accounts.
Ransomware encrypted the Microsoft and VMware ESXi servers of Chile's National Consumer Service (SERNAC), disrupting its systems and online services and prompting the government CSIRT to issue a state-wide cybersecurity alert.
A LockBit 3.0 ransomware attack on NHS software supplier Advanced took down the NHS 111 triage service and forced clinicians back to pen and paper, exposing data on tens of thousands of patients and drawing a ยฃ3.07 million ICO fine.
LockBit operators infiltrated parts of German auto-parts giant Continental AG's IT systems in August 2022. Containment was initially declared, but in November the group put 40 terabytes of stolen Continental data on its dark-web leak site, offered for sale or destruction for $50 million.
The Hive ransomware group crippled Costa Rica's national public-health insurer, the CCSS, encrypting more than 800 servers, forcing hospitals back to paper, and cancelling tens of thousands of medical appointments.
The BlackCat/ALPHV ransomware gang encrypted around 3,000 computers of Austria's Carinthia state government and demanded $5 million, halting passport issuance, traffic-fine processing and COVID-19 contact tracing for weeks. The state refused to pay and rebuilt from backups.
Conti encrypted 27 Costa Rican government institutions including the Ministry of Finance, paralyzing tax collection and customs for months. President Chaves declared a national emergency โ the first cyber-incident state of emergency in history.
A ransomware attack attributed to the Vice Society gang paralysed Greece's national postal operator ELTA for roughly eight days, halting financial services and pension payments, with data later leaked and a โฌ2.99 million GDPR fine in 2024.
The Hive ransomware gang hit Rompetrol, operator of Romania's largest oil refinery Petromidia, demanding a $2 million ransom and knocking out the Fill&Go payment service and corporate websites while refinery operations continued.
An attack on Toyota plastics-and-electronics supplier Kojima Industries paralysed one server enough to halt production at all 14 of Toyota's Japanese plants โ about 13,000 vehicles of daily output โ making the case the canonical example of just-in-time manufacturing's cyber-fragility.
The BlackCat (ALPHV) ransomware gang struck aviation ground-handling giant Swissport, delaying flights at Zurich Airport and stealing 1.6 TB of data that was later leaked online.
The Lapsus$ group seized the Amazon Web Services account of Impresa, Portugal's largest media conglomerate, knocking the Expresso newspaper and SIC television channels offline, defacing their websites and hijacking Expresso's verified Twitter account in what authorities called the country's largest ransomware attack.
A ransomware attack encrypted the central systems of Amedia, Norway's largest local-newspaper group, halting presses and disrupting subscription and advertising systems for more than 70 titles serving around 2 million readers. Amedia refused to pay.
A Hive ransomware attack on Newfoundland and Labrador's health-care network crippled IT systems across the province, forcing the cancellation of thousands of appointments and procedures in what officials called the worst cyberattack in Canadian history.
DeepBlueMagic ransomware paralysed Israel's Hillel Yaffe Medical Center, locking every hospital computer system. As a government-owned hospital barred from paying ransom, it ran on paper and alternative systems for weeks, taking roughly two months to fully recover.
A ransomware intrusion using a Cobalt Strike beacon forced Ecuador's largest private bank, Banco Pichincha, to take ATMs, online banking, and its mobile app offline for several days.
The AvosLocker ransomware gang attacked the Dubai branch of NHS-affiliated Moorfields Eye Hospital, exfiltrating roughly 60 GB of patient and staff data including ID cards, insurance claims and internal records, then dumping it online.
A RansomEXX ransomware attack encrypted the datacenter of Italy's Lazio Region, knocking the COVID-19 vaccination booking portal offline for days and triggering a domestic terrorism investigation.
A ransomware attack on South Africa's state-owned logistics firm Transnet shut down operations at Durban, Ngqura, Port Elizabeth and Cape Town container terminals, forcing the operator to declare force majeure. Durban โ 60% of Southern Africa's containerised trade โ reverted to paper-based clearance for cargo for a week.
The RansomEXX gang hit Ecuador's state-run telecom CNT, disrupting its payment portal and call centers and claiming to have stolen more than 190 GB of corporate and customer data.
Swiss price-comparison portal Comparis was knocked offline by ransomware and faced a roughly $400,000 demand; investigators later found attackers had accessed some internal customer data.
REvil affiliates encrypted the world's largest meat processor, shutting down beef and pork plants across the U.S., Canada, and Australia. JBS paid an $11 million ransom โ one of the largest publicly-confirmed ransomware payments at the time.
A Zeppelin ransomware attack crippled New Zealand's Waikato District Health Board, taking down clinical systems and phone lines across five hospitals for weeks, postponing surgeries, and leaking patient and staff data on the dark web.
Conti ransomware paralysed Ireland's Health Service Executive, forcing cancellation of outpatient appointments nationwide for weeks. Conti released the decryptor for free; recovery still cost an estimated โฌ100M+.
Conti operators tricked an HSE user into downloading a booby-trapped Excel attachment; the resulting ransomware forced the Health Service Executive to shut down all of Ireland's healthcare IT systems and exfiltrated 700 GB including COVID-19 vaccination PHI. Recovery cost exceeded โฌ100 million.
A reused VPN password let DarkSide encrypt Colonial Pipeline's billing systems. The operator shut down 5,500 miles of fuel pipeline for six days, paid $4.4M, and triggered a federal emergency.
The Babuk ransomware gang breached Spanish mobile retailer The Phone House and leaked roughly 100 GB of customer data โ names, ID numbers, bank details and contact information on up to 3 million people โ after the company refused to pay.
HelloKitty ransomware encrypted CD Projekt Red devices and exfiltrated source code for Cyberpunk 2077, The Witcher 3, Gwent, and an unreleased version of The Witcher 3. CDPR refused to pay; the data was auctioned and reportedly sold to a private buyer.
The Black Shadow group breached Israeli insurer Shirbit, stealing ID cards, passports, financial and medical documents, and demanded a bitcoin ransom that escalated toward $1 million. When Shirbit refused, the attackers leaked customer data in stages.
The RansomExx gang encrypted more than 1,000 servers at Brazil's Superior Tribunal de Justiรงa, paralysing the country's second-highest court for over a week in the most severe cyberattack ever against a Brazilian public institution.
The Clop ransomware gang breached German enterprise-software giant Software AG, demanded a $23 million ransom, forced internal systems offline, and leaked over a terabyte of stolen company and employee data after negotiations failed.
NetWalker ransomware crippled the billing and online systems of Karachi's sole electricity supplier and demanded a $3.85 million ransom that would double to $7.7 million; when K-Electric refused, the gang dumped an 8.5 GB archive of stolen data online.
REvil (Sodinokibi) ransomware encrypted roughly 14,000 workstations at BancoEstado, one of Chile's largest banks, forcing it to close all branches nationwide for a day while ATMs, online banking, and customer funds were kept unaffected by network segmentation.
Netwalker ransomware encrypted the systems of Argentina's national immigration agency, halting all border crossings for about four hours and prompting a $4 million ransom demand that the government refused to pay.
Attackers breached Swedish physical-security firm Gunnebo, stole 19 GB of data, and after the company refused to pay, leaked bank-vault floor plans, alarm schematics, and security arrangements for high-value clients including a Swedish parliament building.
Evil Corp deployed the WastedLocker ransomware against Garmin, taking flyGarmin aviation services, Garmin Connect, and inReach satellite messaging offline for five days. Garmin paid an estimated $10M ransom despite OFAC sanctions on Evil Corp.
A ransomware attack forced Brno University Hospital โ one of Czechia's largest hospitals and a major COVID-19 testing centre โ to shut down its entire IT network, cancel surgeries, and divert acute patients at the height of the early pandemic.
Clop ransomware encrypted backend servers at INA Group, Croatia's largest oil company and petrol-station chain, knocking out invoicing, loyalty cards, e-vignettes, mobile vouchers and utility-bill payments while fuel sales continued.
A ransomware attack paralysed weaving-machine manufacturer Picanol's plants in Ieper (Belgium), Romania, and China, halting production for ~2,300 employees for over a week. Trading in Picanol shares was suspended during the disruption.
REvil/Sodinokibi operators detonated against Travelex on New Year's Eve 2019 after dwelling in the network for six months via an unpatched Pulse Secure VPN. Travelex paid $2.3 million; parent Finablr failed; PwC put Travelex into administration with the loss of over 1,300 jobs.
TA505 used Clop ransomware to encrypt 267 Maastricht University servers over Christmas 2019 after two phishing emails on 15โ16 October had compromised the network. The university paid 30 BTC (~$220,000). The ransom Bitcoin โ later seized from a money mule โ was returned and had appreciated, leaving the university ahead by ~$300,000.
Canada's largest medical-testing laboratory disclosed that attackers had accessed health data on roughly 15 million customers, paid an undisclosed ransom to retrieve the stolen records, and was later found by privacy regulators to have failed to safeguard the information.
An EmotetโTrickBotโRyuk malware chain crippled the Rudolf and Stefanie Hospital in Beneลกov, Czech Republic, knocking out X-ray, ultrasound, and laboratory systems and paralysing the facility for weeks. The hospital did not pay the ransom and reported no patient-record loss.
DoppelPaymer ransomware paralysed corporate IT systems at Mexican state oil company Pemex, freezing payments and communications for weeks. Attackers demanded 565 BTC (~$5M). Pemex refused to pay; total recovery cost reached approximately $71 million.
A ransomware-style cyber incident forced Danish hearing-aid giant Demant to shut down IT systems worldwide, crippling production and order processing and causing an estimated loss of up to $95 million โ one of the costliest single ransomware events on record.
Aluminium producer Norsk Hydro lost most of its global IT estate to the LockerGoga ransomware. Hydro publicly refused to pay, ran operations on paper for weeks, and set the editorial standard for transparent incident communication.
A WannaCry ransomware variant spread through unpatched Windows 7 fabrication tools at TSMC, the world's largest contract chipmaker, halting production at plants in Hsinchu, Taichung, and Tainan and causing an estimated $170 million in losses.
On the day WannaCry erupted worldwide, the worm tore through the corporate network of Spanish telecom giant Telefรณnica, forcing the company to order thousands of staff at its Madrid headquarters to shut down their PCs.
A North Korean ransomware worm that exploited the EternalBlue SMB vulnerability to spread to ~200,000 systems across 150 countries in 24 hours. Paralysed the U.K.'s NHS and crippled manufacturing globally.