Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2841 articles
Beast ransomware claims it breached Xiamen Tungsten and is offering an alleged infrastructure dump for 20 Bitcoin. The actor says it contains over 150GB of SQL backups with personal, business, and manufacturing data.
A ransomware.live-monitored post attributes an extortion and data-exfiltration claim against jursaconsulting in Slovakia to Qilin. The post says the claim is unconfirmed.
A leak-site claim attributed to Qilin alleges CHEK News was targeted with ransomware, with data encryption and a ransom demand. The group reportedly threatened to publish stolen information; the claim is unconfirmed.
A ransomware monitoring post attributes a claim against Neurologic Associates of Central Brevard, a US healthcare organization, to Qilin. The claim is unconfirmed, and no scope, impact, or data-exfiltration details are disclosed.
ShadowByt3s claims it exfiltrated 10 GB of Starbucks source code, firmware and management tools from an S3 bucket. The article reports a ransom deadline of April 5, 2026; the breach remains unconfirmed.
DragonForce claims it breached Blossman Gas, identified through blossmangas[.]com. The ransomware.live record links to the group's leak-site post but says the claim has not been independently confirmed.
The incransom ransomware group reportedly claims it has 800GB of Lincoln Property LLC data, including confidential business, financial and personal information. The monitoring post says the claim is unconfirmed.
Ransomware.live lists First Trinity Financial as a DragonForce claim target; the group allegedly demanded payment and threatened to publish sensitive financial data. The post says the claim is unconfirmed.
Ransomware.live lists SAYEGH as a victim in a claim attributed to the Payload ransomware group. The post describes Sayegh 1944 as an education company; the claim is unconfirmed.
NightSpire claims to have breached GMP Group, Ghazi Brothers and Notre-Dame du Grandchamp. The group says it took over 2.3 TB from GMP Group and Notre-Dame; Ghazi Brothers’ data is listed as unavailable.
Anubis claimed that it compromised Publishers Clearing House. The claim was listed on the group's leak site and monitored by ransomware[.]live; the post says it could not confirm the claim.
The Everest extortion group claims it accessed Nissan and Infiniti North American dealer systems through a third-party IT contractor and exfiltrated 910 GB of data. The alleged access and exposure details are unverified.
Inc claims it hacked Meriden, Connecticut, and posted sample documents on its data leak site. City officials reported weeks of service disruptions but have not confirmed a breach or what data, if any, was compromised.
Nightspire is reported to claim it breached Notre-Dame du Grandchamp in France, encrypting and exfiltrating student, medical, HR, and administrative data. The claim is unconfirmed.
Ransomware.live reports that the genesis group claims it targeted U.S.-based MC-Rx, alleging file encryption, possible data exfiltration, and extortion. The post says the claims are unconfirmed.
Genesis claims HMI Elements in the UK as a ransomware victim. The record is monitored by ransomware[.]live, but the claim is not independently confirmed.
Genesis claims it encrypted Green Giftz, a US-based branded merchandise agency, and exfiltrated sensitive data, threatening publication unless a ransom is paid. The report says the claims are unconfirmed.
Genesis reportedly claimed it compromised Raphael Ortho, a US dental practice management company, and encrypted data. The claim is unverified; the article says patient data may have been exposed.
ransomware[.]live reports that Qilin claims to have targeted SERAM SpA in Italy. The claim is unconfirmed; the article provides no details about the attack method, ransom amount, or data impact.
Ransomware.live lists an unconfirmed Everest ransomware claim naming Nissan Motor Co., Ltd. The record says it was discovered and published on April 1, 2026; no incident details are independently confirmed.
A ransomware.live monitoring post attributes a claim against Australian company Seeing Machines to Qilin. The post says the claim is unconfirmed and provides no further incident details.
A ransomware claim naming Service Star Freightways and attributed to Qilin was recorded on March 31, 2026. Potential data exfiltration and operational disruption are unconfirmed; the post says the information cannot be verified.
A ransomware.live monitoring record attributes an unverified claim involving B&R Sheet Metal to the group genesis. The record provides no details about alleged access, data, encryption, or impact.
A ransomware.live-monitored entry attributes a ransomware incident claim against Catalyst Learning Company to Genesis. The entry alleges operational disruption and potential data exposure; these claims are unconfirmed.
