Krybit Claims to Have Hacked 0APT
A post attributed to ransomware actor krybit claims it hacked 0APT. The claim is unconfirmed; the article says it cannot verify the information.
Ransom Monitor
Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2837 articles
Lamashtu Claims LACROIX as a Ransomware Victim
Ransomware.live lists LACROIX, described as a Quebec automotive-parts retailer, in a ransomware claim attributed to Lamashtu. The post says the claim is unconfirmed; its country field lists France.
DragonForce Claims Ransomware Incident at Apply Capnor
A ransomware.live monitoring post attributes an alleged ransomware incident against Apply Capnor to DragonForce, which reportedly claims encryption and possible data exfiltration. The post says the claims are unconfirmed.
Nightspire Claims Ransomware Incident at Mexico’s D-Troy Logistics
Nightspire claims it compromised internal documents and employee records at Mexico’s D-Troy Logistics. The post is based on the group’s public claim, which the author says is unconfirmed.
Akira Claims Ransomware Attack on La Tuilerie, Threatens to Leak 11 GB
A ransomware.live-monitored post attributes to Akira an unverified claim targeting France’s La Tuilerie, threatening to release 11 GB of company data if demands are not met.
Akira Claims It Will Publish 10 GB of CSA SpA Data
Akira claims it will soon publish 10 GB of data from Italian shipping and logistics company CSA SpA, including employee, financial, contract, and client files. The claim is unconfirmed.
LockBit5 Claims gas.mercedes-benz.com.eg in Ransomware Listing
A ransomware.live monitoring record attributes a ransomware claim for gas[.]mercedes-benz[.]com[.]eg in Egypt to LockBit5 and links to a LockBit5 post. The claim is unconfirmed.
Indigo Group Named in Unverified Ransomware Claim by secpo
A ransomware.live-monitored post attributes a claim against Indigo Group to secpo, alleging a dataset with over 897,000 unique files and sensitive information on more than 27,000 individuals and organizations. The publisher says the claims are unconfirmed.
Secpo Claims Data Exfiltration from JM Bozeman Enterprises
Secpo claims to have exfiltrated more than 100,000 unique files from JM Bozeman Enterprises, containing sensitive information about individuals and organizations. The claim is unconfirmed.
Lamashtu Claims GRUPO RONDA in Ransomware Listing
A ransomware claim attributed to lamashtu names Mexico-based GRUPO RONDA as the victim. The claim is linked to an actor post and monitored by ransomware.live; its accuracy is unconfirmed.
Lamashtu Claims CNAOC in France as a Ransomware Victim
Ransomware.live reports that the actor lamashtu claimed CNAOC in France as a victim. The claim is unconfirmed; the article provides no independent evidence of compromise or impact.
Lamashtu Claims Gauthier Tissus as a Ransomware Target
Ransomware.live lists a claim by lamashtu targeting Gauthier Tissus, a France-based fabric manufacturer. The monitoring post says the claim is unconfirmed.
Worldleaks Claims Jersey Fabrication Group LLC as a Ransomware Victim
Worldleaks listed Jersey Fabrication Group LLC, a U.S. manufacturer, in a ransomware claim published April 13, 2026. The claim is unconfirmed; the post cites the group's leak site and ransomware.live monitoring.
Lynx Lists cwwcontractors.com in Unverified Ransomware Claim
A ransomware.live monitoring record attributes a claim involving cwwcontractors[.]com to Lynx and links to a leak-site listing. The post says the claim is unconfirmed.
Qilin Claims Ransomware Incident Against Herth+Buss
Qilin claims a ransomware incident against German manufacturer Herth+Buss. The claim is attributed to a leak-site listing and monitored by ransomware[.]live, but is unconfirmed; impact and affected systems or data are unknown.
DragonForce Claims Breaches of Six Organizations, Including RUDOLF Medical and Lift AG
DragonForce claims to have breached six named organizations and listed them on its public leak site. The group reportedly claims data including internal documents, financial records, medical visit records, and elevator specifications; the allegations are unconfirmed.
Akira Claims Breach of DeMera DeMera Cameron and Threatens to Leak 260 GB
A ransomware.live monitoring record attributes to Akira an unconfirmed claim that it breached Fresno-based CPA firm DeMera DeMera Cameron and will leak 260 GB of corporate and client data.
DragonForce Claims Ransomware Attack on Travel of America
DragonForce claims it targeted Travel of America, threatening to release customer and partner information and disrupt services unless it receives a ransom. The claim is unconfirmed and monitored by ransomware[.]live.
DragonForce Claims Ransomware Activity Against Eldorado Trading Group
DragonForce claims ransomware activity against edtg[.]com, identified as Eldorado Trading Group. The monitoring post attributes the claim to the group and says its accuracy is unconfirmed.
Coinbasecartel Claims Breaches of Carters, Ralph Lauren and Helzberg
Coinbasecartel claims it breached Carters, Ralph Lauren and Helzberg, alleging theft of full supply chain data from Carters and Ralph Lauren and 33GB from Helzberg. The claims are unverified in the article.
Ransomhouse Claims Transaction Packing Inc. as a Victim
A ransomware.live monitoring post attributes an unverified claim against Houston-area freight handler Transaction Packing Inc. to ransomhouse. The post says the group targeted the company; it provides no independent confirmation.
ShadowByt3$ Claims Data Theft and Ransom Demand Against Forestal Atlántico Sur
ShadowByt3$ claims it exfiltrated about 9.24 GB from Forestal Atlántico Sur’s S3 buckets and Azure blobs, threatens to sell the data, and set a 72-hour ransom-negotiation deadline. The claims are unconfirmed in the article.
Everest Claims K Subsea Group Breach, Alleging Encryption and Ransom Demand
Everest allegedly claimed K Subsea Group as a victim, alleging data encryption and a ransom demand. The post says the claim may involve disruption to offshore energy projects but notes it is unconfirmed.
coinbasecartel Claims Helzberg Diamonds Was Targeted, Causing U.S. Disruptions
coinbasecartel claims it targeted Helzberg Diamonds and caused operational disruptions across the United States. The monitoring post says the claim is unconfirmed.