Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2838 articles
A ransomware claim listing names Hofland in the Netherlands and attributes it to Qilin. The post says details are unavailable and the claim, based on public group claims, has not been independently confirmed.
TiMc claims it breached Oncologica, took control of its intranet and exfiltrated over 1 TB of data, including a COVID-19 database, OncoMine KB source code and PII. The monitoring post says the claims are unconfirmed.
A monitoring post says AiLock claims to have compromised Alvi Associates, an infrastructure engineering firm. The claim is unconfirmed; the post cites public claims by AiLock and is monitored by ransomware[.]live.
Insomnia claims it compromised United Medical Doctors, encrypted systems, and may expose or release patient data unless a ransom is paid. The monitoring post says the claims are unconfirmed.
Ransomware actor pear claims to have targeted The McLamb Group, Inc.; the post says operations were reportedly disrupted but notes the claim is unconfirmed.
incransom claims it targeted Kannarr Eye Care and caused operational disruption, with potential data exposure. The claim is attributed to the group’s disclosure site and monitored by ransomware.live; it has not been independently confirmed.
Ransomware.live reports that Incransom claims a “700 GB NDA” involving Taiwan-based manufacturer Martek Co., Ltd. The post cites the group’s leak-site disclosure; the claim is unverified.
A ransomware-monitoring post lists Goulston & Storrs and SilentRansomGroup, citing public claims by the group; ransomware[.]live monitored the listing. The post says it cannot confirm the claim.
A ransomware.live monitoring record attributes an unconfirmed ransomware targeting claim involving Cox, Castle & Nicholson LLP to SilentRansomGroup. The post says the claim’s accuracy could not be confirmed.
Krybit claims it breached South African ISP and data center operator Megasurf, exfiltrated data, and demanded ransom from the company and its customers. The claims are unconfirmed.
A claim attributed to ransomware group pear names U.S. law firm Powell, Powell & Powell, P.A. The monitoring post says the claim is unconfirmed; it lists an April 6, 2026 publication date.
Kairos claims it compromised South Florida Injury Centers. The report suggests possible encryption and data access, but provides no independently verified details.
Ransomware actor pear claims access to sensitive data from Family Psychological Associates and threatens disclosure if demands are not met. The claim is unconfirmed.
The ransomware actor pear claims Siegel Lewitter Malkani was targeted and suggests possible data exfiltration or encryption and a payment demand. The post says the claims are unconfirmed and is monitored by ransomware[.]live.
Anubis claims a ransomware operation against Signature Healthcare and threatens encryption and possible data exfiltration. The claim is unconfirmed, and whether data will be released is uncertain.
ALP-001 claims it targeted NEP Group, cites 70GB of storage and says 10GB of samples were uploaded. The post gives an April 18, 2026 deadline and says the claims cannot be confirmed.
ALP-001 claims it compromised UK cloud provider Inatech, stole 51GB of data and posted 61 sample files to a leak page. The group set an April 18, 2026 deadline; the report says the claim is unconfirmed.
Ransomware[.]live lists irmler[.]org, a German law firm, as a victim claimed by the ransomware actor beast. The post links to the actor's claim and says it cannot confirm the information.
CoinbaseCartel claims it exfiltrated approximately 1.5 TB of data from Idera. The claim is attributed to the group’s leak-site listing and is unconfirmed.
A ransomware.live monitoring record attributes a ransomware claim about EasTech to coinbasecartel. The group’s claims, including data encryption and potential extortion, are unconfirmed; details are sparse.
An AI-generated post reports an unconfirmed ransomware claim by coinbasecartel against Brazil’s state-owned Correios, attributed to the group’s leak site and monitored by ransomware[.]live.
A ransomware claim attributed to coinbasecartel alleges that KEB was compromised, with systems encrypted and possible data exfiltration. The post says operations in Germany were affected; the claims are unconfirmed.
A ransomware claim attributed to coinbasecartel names Scholle IPN as a victim and alleges operational disruption. The post cites a leak-site listing and ransomware.live monitoring; the claim is unverified.
A ransomware.live record attributes to coinbasecartel a claim against UK advisory firm Marlborough Partners, alleging encrypted systems and potential data exposure. The claim is unconfirmed.
