Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2841 articles
A ransomware claim attributed to nightspire says Carmelo Candy Inc. was targeted, with file encryption and a ransom demand. The post is based on public claims and says the information is unconfirmed.
A ransomware.live record attributes a public ransomware claim against St. Fabian Catholic Church & School in Farmington Hills, Michigan, to thegentlemen. The post says the claim is unconfirmed.
Thegentlemen claimed a ransomware incident targeting GCA Group LLC, with Japan listed as the impacted country. The claim is unverified; the article says it is based on the group’s public claims.
Ransomware.live records an unconfirmed claim by thegentlemen that it accessed GCA Professional and may publish data. The record is dated April 4, 2026.
Thegentlemen claim to have compromised Austrian diagnostic laboratory Das Labor. The post, monitored by ransomware[.]live, says the claim is unconfirmed; no independent evidence of compromise is provided.
A monitoring post attributes a ransomware claim naming Bojonegoro Regency’s government to Nova. The post says the claim is unconfirmed.
A ransomware.live monitoring post records an unconfirmed nova claim naming Polish mattress and bed manufacturer M&K Foam Koło. The post provides no details confirming compromise, encryption, or data theft.
A ransomware claim attributed to Lapsus$ alleges an incident at VirtaHealth involving healthcare research data, encryption, payment demands, and operational disruption. The claims are unconfirmed; ransomware[.]live is cited as the monitor.
A monitoring post attributes an unverified claim to lapsus$ that AstraZeneca data—including source code, employee records, API keys, and database credentials—was exfiltrated.
Lapsus$ claims it breached UNIV LILLE and stole student and staff records, threatening publication unless a ransom is paid. The claim is unconfirmed and appears in a ransomware[.]live-monitored record.
DragonForce reportedly listed Innovision Holdings in a ransomware claim published April 5, 2026. ransomware.live monitored the claim; the post says it could not confirm the information.
A ransomware claim-monitoring post attributes an attack on France’s Ministry of Agriculture to Lapsus$. Claims of encryption and possible data exfiltration are unconfirmed; the post says it relies on public claims.
A ransomware.live-monitored post attributes to Lapsus$ an unverified claim of an attack on AXCERA[.]IO and release of source code and infrastructure configurations.
A ransomware.live monitoring post attributes an unconfirmed intrusion claim against Italian manufacturer Zanzi S.p.A. to thegentlemen. The group allegedly encrypted critical systems and may have exfiltrated data.
A ransomware claim attributed to theGentlemen names French cosmetics manufacturer AIRCOS. It alleges unauthorized access and possible data exfiltration, disruption, and exposure of proprietary information; the claims are unconfirmed.
The Play ransomware group claims it targeted Sokolin in the United States. The monitoring record does not independently confirm the claim.
A ransomware claim attributed to the Play actor alleges Barnes Solicitors LLP in the United Kingdom was affected. The post says the information is unconfirmed.
DragonForce claims it encrypted data belonging to G Plants Ltd and threatened disclosure unless a ransom is paid. The post also alleges operational disruption, but says the claims are unconfirmed.
DragonForce claims Siam Okamura International Co., a Thailand-based manufacturer, was targeted by ransomware. The claim is attributed to the group’s leak site and monitored by ransomware[.]live; its accuracy is unconfirmed.
Netrunner claims it targeted Harman Fitness in a ransomware incident involving encrypted systems and possible data exfiltration. The monitoring post says the claims are unconfirmed.
A ransomware.live monitoring post attributes to DragonForce claims of ransomware activity against India's Kopran Limited and its subsidiary, including encryption, disruption and threatened data leakage. The post says the claims are unconfirmed.
Ransomware group krybit claims it compromised Livingstone Kolobeng College in Gaborone, Botswana, alleging file encryption and possible data exfiltration. The claim, monitored by ransomware[.]live, is unconfirmed.
A ransomware.live monitoring post records an Anubis claim of a ransomware incident affecting Australian aviation firm Shine Aviation; the post says the claim is unconfirmed.
The ransomware group netrunner claims it breached Jordan India Fertilizer Company (JIFCO), encrypted systems and exfiltrated data; the post says the claims are unconfirmed.
