Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2835 articles
The Everest ransomware group claims its extortion portal lists six organizations and more than 380 GB of data, including banking records, personal identifiers, payment details and aviation files; the claims are unverified.
Krybit claims it compromised imbriefamilylaw[.]com, encrypted data, and demanded payment. ransomware[.]live lists the claim; the post says it cannot independently confirm it.
An unconfirmed ransomware claim attributed to Everest names Citizens Bank as the victim. The post cites the group's public claim and lists discovery and publication on April 20, 2026; compromise or data theft is not independently confirmed.
A monitoring record attributes a ransomware claim about Indonesia’s Tokoparts to Everest. The group reportedly claimed encryption and potential data exposure; the post says the claims are unconfirmed.
ShadowByt3$ reportedly claims it compromised Stride Learning, stole corporate files and intellectual property, and demands $500,000. The actor says no student or teacher information was taken; the claims are unconfirmed.
Everest claims it attacked Complete Aircraft Group, encrypted systems and threatened a data leak. The claim was attributed to Everest’s leak site and monitored by ransomware[.]live; the publisher says it is unconfirmed.
Everest claims it breached Umiles Group, deployed ransomware, and threatened disruption and data exfiltration unless demands were met. The claim is unconfirmed; ransomware.live says it monitors the record.
A post monitored by ransomware.live attributes to Everest an unconfirmed claim that it compromised NutraBio, encrypted systems, exfiltrated data and demanded payment.
ShinyHunters claim over 600,000 7-Eleven Salesforce records containing PII and internal data were compromised, and issued a pay-or-leak deadline of Apr. 21, 2026. The claim is unconfirmed.
ShinyHunters claims more than 25 million Pitney Bowes Salesforce records containing PII were compromised and demands payment to prevent a leak. The monitoring post says the claim is unconfirmed.
ShinyHunters claims Canada Life's Salesforce held over 5.6 million records containing PII and threatens to leak them unless paid by April 21, 2026. The monitoring post says the claim is unconfirmed.
ShinyHunters claims Aman Resorts has over 500,000 Salesforce records containing PII and threatens to leak them unless contacted by April 21, 2026. The claim is unverified.
Ransomware.live reports a Qilin claim naming The Great Cookie as a victim. The post says the claim is based on the group's public claims and cannot be independently confirmed; it provides no further incident details.
A ransomware.live record attributes a ransomware claim affecting Nanometrics in the US to Qilin. The claim is unconfirmed; ransom demands, encryption methods, and data exfiltration details are unavailable.
A ransomware.live monitoring record attributes to Termite an unconfirmed claim that Millennium Dental Technologies’ systems were encrypted and data exfiltrated.
Ransomware[.]live lists an unverified coinbasecartel claim naming “Evict them for me” as a victim. The claim describes encryption and a payment demand; no country is specified.
A ransomware.live monitoring record says coinbasecartel listed McCuaig and Associates Engineering on Apr. 18, 2026, alleging encryption and possible data exposure. The post's accuracy is unconfirmed.
A ransomware claim naming Altpro was attributed to actor coinbasecartel and recorded on April 18, 2026. The post says the claim is unconfirmed; the affected country is unspecified.
Ransomware.live reports an unverified ransomware claim by coinbasecartel naming ASTM Group in the US; the post says it cannot confirm the claim.
A ransomware.live monitoring post attributes an unconfirmed ransomware and extortion claim against France-based Securitevolfeu to CoinbaseCartel. The post says the claim is AI-generated and cannot be confirmed.
A monitoring post attributes a ransomware claim involving HS Technology Group to Qilin and cites an onion-site source. The claim is unconfirmed; the post provides no country, impact, or operational details.
A ransomware.live post attributes to incransom an unverified claim that Mag. F,ünder Hausverwaltungs GmbH in Austria was compromised, its data encrypted, and publication threatened unless a ransom is paid.
Ransomexx claims 951 MB of SOGO Auction data was leaked. The post says the claim is based on the group’s public statements and cannot be independently confirmed.
A monitoring post lists Winnitex (Americas) Limited as a RansomHouse ransomware victim, citing the group's public claim. The post says the claim is unconfirmed; it provides no independently established compromise details.
