Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2835 articles
The ransomware group krybit claimed an incident involving rhode-hv[.]de, identified as iseg Spezialelektronik GmbH. The monitoring post says the claim is unconfirmed; it provides no independent evidence of compromise.
Ransomware.live reports that the incransom group listed Saudi aluminium producer ALUPCO, alleging data encryption and possible exfiltration. The claim is unconfirmed; the article provides no independent confirmation.
The kairos ransomware group is reported to claim it compromised Strata Republic, encrypted systems and demanded a ransom. The monitoring post says the claim is unconfirmed and alleges disruption to strata services in New South Wales.
A ransomware claim listing names Limkon as a victim and attributes it to Qilin. The post was published and discovered on April 15, 2026; the claim is unconfirmed and includes no further incident details.
Ransomware.live lists an unverified vect claim that 700 GB of Guesty data, including its userbase and Airbnb/Booking[.]com information, was stolen; negotiations are reportedly ongoing.
A ransomware[.]live record attributes an unverified extortion claim to actor vect, listing S&PGLOBAL and a LiteLLM/Trivy campaign, with alleged 250 GB of internal projects, secrets and API keys; status is negotiating.
A ransomware.live record attributes to DragonForce a claim that it compromised Empower Group, with possible service disruption and data exposure. The claim is unconfirmed; the article provides no independent evidence of compromise.
A ransomware claim attributed to Payload lists Australian company TFE Group as a victim. The monitoring post says the claim is unconfirmed.
Ransomware.live lists Oriental Weavers as a victim in an unconfirmed claim attributed to Payload. The post provides no details on access, affected data, encryption, or impact.
Payload claims it encrypted Sunlight Express Airways systems supporting ticketing, reservations and Sunlight Miles, and threatens to disclose passenger and operational data. The monitoring post says the claims are unconfirmed.
A ransomware.live monitoring post attributes a claim about Marino Food Products Pvt to Payload. The post alleges file encryption and disruption to online ordering and retail operations; the claims are unconfirmed.
A ransomware.live record attributes a ransomware claim involving Franziskusschule Wilhelmshaven, a school in Germany, to the actor payload. The post is unconfirmed; no independent evidence is provided.
Lamashtu claims it targeted Romanian pharmaceutical company Biotehnos and says the incident affected operations. The claim is attributed to the group’s leak-site post and has not been independently confirmed.
SilentRansomGroup claims it breached Harris Beach Murtha, encrypted files and threatened to publish sensitive client data unless paid. The post says the claim is unconfirmed.
Qilin claims it compromised Clearwater Marine Aquarium, encrypted files, and threatens to publish allegedly exfiltrated data unless a ransom is paid. The post says the claim is unconfirmed.
Kairos claims it compromised Australia’s FriendlyCare Pharmacy, encrypted systems, may have exfiltrated customer data, and demanded ransom while threatening disclosure. The post says the claims are unconfirmed.
Interlock claims it breached the University of Warsaw’s Faculty of Management and exposed information about students, instructors, professors, and student work. The claim is unconfirmed.
A ransomware claim listing attributed to coinbasecartel named The Epoch Times on April 15, 2026. The article says the claim is unconfirmed and links it to the group's leak site.
A post attributed to coinbasecartel claims it compromised Canada Goose data and threatens release unless a ransom is paid. The article says the claim is unconfirmed and is monitored by ransomware[.]live.
A ransomware.live monitoring post attributes an unconfirmed ransomware and extortion claim against ITC Group to Chaos. The group reportedly claims files were encrypted and sensitive data could be released unless a ransom is paid.
Chaos claims it breached coastappliances[.]com, encrypted its systems and demanded a ransom. The ransomware.live-monitored record says the claim is unconfirmed.
A ransomware claim attributed to Lynx lists Thailand-based Stonehenge Co Ltd as a victim. The post cites a leak-site listing but says the claim is unconfirmed and provides few details about impact or any ransom demand.
Ransomware.live records Exitium’s unverified claim targeting Gastroenterology & Hepatology of CNY, alleging a posted data sample and threatening sale of its database if ransom is not paid.
A ransomware.live-monitored post attributes a ransomware claim naming Flash Charm Inc. (IDERA) to coinbasecartel. The post says the claim is unconfirmed.
