Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2842 articles
Akira claims it will release 15 GB of Dean Supply corporate data, allegedly including employee medical information, NDAs, financials, project documents, and contracts. The claim is unconfirmed.
Ransomware.live lists Q-Lab in a Qilin ransomware claim dated March 31, 2026. The post says details, ransom amount and encryption scope are unavailable; the claim is unconfirmed.
A ransomware.live monitoring record says Qilin named Chickasaw Holding as a victim. The claim is unconfirmed; the record lists March 31, 2026, discovery and publication times.
Nightspire claims it compromised JT-ATFP, LLC and alleges access to and potential exfiltration of sensitive data, including contract, employee, and defense-project information. The claim is unconfirmed.
A ransomware.live monitoring record attributes a claim naming Beltran & Garcia Financial Investment SLU to the group nightspire. The claim is unconfirmed, and the data status is listed as unavailable.
Everest claims it compromised Panama’s Parque Eólico Toabré, encrypted wind-farm control systems and demanded a ransom. The claim threatens disclosure of operational data and possible disruption; it is unconfirmed.
A post monitored by ransomware.live attributes a ransomware attack on Japan-based CERUMO Co., Ltd. to NightSpire and says data is inaccessible. The post says the group’s claim could not be confirmed.
ShinyHunters claim they compromised more than 7.9 million Salesforce records tied to Hallmark Cards, Inc. and Hallmark Plus, and warn of a leak unless contacted by April 2, 2026. The claim is unconfirmed.
Ransomware.live lists Miller & Steele Law Firm (millersteelelaw[.]com) as an Incransom victim, citing the group’s leak-site disclosure. The claim is unconfirmed; the post says it cannot verify the information.
Incransom claims it compromised domingogarcia.com, encrypted data and threatened to leak sensitive information unless a ransom is paid. The monitoring post says the claim is unconfirmed.
Ransomware.live lists Efficy as a claimed victim of coinbasecartel, which alleges it leaked 43 GB of data. The post says the claim is unconfirmed.
A ransomware.live monitoring record attributes an auction-style claim targeting Propertyfinder / PropSpace CRM to coinbasecartel. The claim was not independently confirmed, and the article provides no country, sector, or verified incident impact.
A ransomware.live record attributes a public ransomware claim against Wm Erath & Son to Qilin, with a leak-site listing dated March 30, 2026. The article says the claim is unconfirmed.
Ransomware.live records an unverified Qilin ransomware claim targeting Dow, discovered and published on March 30, 2026. Ransom-note and encryption details are unavailable.
A ransomware.live post attributes to handala an unconfirmed claim that an attack on North Country Business Products disabled 2,680 POS terminals nationwide; the author says the claim could not be verified.
A ransomware claim attributed to Qilin lists UK financial services firm Blantyre Capital. The post cites a leak-site listing and ransomware.live monitoring; the claim is unconfirmed.
Exitium claims it stole 278 GB of files from IKRON, including sensitive records, and encrypted Ming Hwei Energy’s corporate infrastructure. The claims are not independently confirmed in the article.
Alp-001 claims it exfiltrated about 1.64 TB from KOB 4, Knewin, Kyocera Document Solutions Europe, Lacor, and Polsat. The claims are unverified in the article.
The Inc ransomware group claims it compromised Conveyors, Inc. and Greenology Products, alleging exposed files include employee records, I-9 forms, financial documents, agreements and internal memos. The claims are unverified in the article.
A ransomware[.]live monitoring record attributes an unverified claim to sarcoma, which alleges it exfiltrated 1.5 TB of data, including SQL databases, from GYF, an IT services company in Argentina.
Ransomware.live records ALP-001’s unverified claim that it breached Brazil-based Knewin and affected 176.5 GB of data, with an extortion deadline of April 3, 2026.
A ransomware.live-monitored record attributes a claim naming US manufacturer Conveyors, Inc. to incransom. The claim is unverified; the article says it cannot confirm the information.
Qilin claims Doctor.com was compromised and says it exfiltrated 205 GB of data across 104,392 files. The claim is attributed to the ransomware group and is not independently confirmed in the article.
incransom claims a ransomware incident targeting Greenology Products and threatens data encryption or exposure. The claim is attributed to the actor’s disclosure page and monitored by ransomware.live; the breach is not independently verified.
