Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2842 articles
A ransomware claim attributed to DragonForce names Alliance Select Foods International, alleging data encryption and a ransom demand. The claim is unconfirmed; the article says the company is assessing potential impact.
Qilin claims it compromised U.S. healthcare organization Doctor.com. The claim is unverified; no ransom amount, encryption method, or data-leak details are confirmed.
ransomware.live records an unconfirmed ALP-001 claim targeting kob[.]com. The listing reports $22 million in revenue, 1.127 TB of storage, and a deadline of April 2, 2026.
Ransomware.live reports Exitium’s claim that it encrypted Ming Hwei Energy’s infrastructure in Taiwan. The post says operations were affected, but notes the claim is unconfirmed.
A ransomware.live record attributes to ALP-001 a claim that 75 GB of Kyocera Document Solutions Europe storage was compromised. The post says the claim is unconfirmed.
An Unverified claim attributed to ALP-001 says lacor[.]es was compromised and 182.71 GB of data was exfiltrated. The monitored post gives an April 8, 2026 deadline; the article says it cannot confirm the claim.
A ransomware[.]live listing attributes an unconfirmed claim to ALP-001, naming polsat[.]pl as the victim and alleging 75.71 GB of data. The article says it cannot verify the claim.
A ransomware.live-monitored post attributes an unverified claim to ShinyHunters that the European Commission was breached and 350 GB+ of data, including mail-server and database dumps, was compromised.
A ransomware.live record attributes an unverified claim targeting Terix to ALP-001. The record cites Terix’s revenue and storage capacity but does not establish that data was stolen or systems were compromised.
A ransomware claim attributed to coinbasecartel names Genobank as a target and alleges a ransom demand concerning sensitive genetic information. The claim is unconfirmed.
A ransomware.live monitoring record attributes a ransomware claim involving Kerjaya Prospek Group in Malaysia to Qilin. The claimed access, encryption and potential data exposure are unconfirmed; incident details and specific impacts were not disclosed.
A ransomware.live-monitored listing attributes a ransomware claim against ITWAL to Qilin. The post says the claim is unconfirmed and provides no additional incident details.
A ransomware claim attributed to payload names Dubai-based A A Al Moosa Enterprises (ARENCO Group). The claim was listed in March 2026 and is unconfirmed; the article says it cannot verify the information.
Akira claims it breached Sheladia Associates and threatens to release company data, reportedly including employee documents, project files, medical and financial information, contracts, client files and internal records. The claim is unconfirmed.
Akira claims Quality Carton and Converting, LLC is a ransomware victim and threatens to release corporate data, including employee documents, HR files, financial records, contracts and client files. The claims are unconfirmed.
Ransomware.live records an unverified Akira claim against GeoMechanics Technologies. The group threatens to upload corporate data, including employee documents, project files, medical and financial information, contracts, and client files.
A ransomware.live post attributes a claim targeting Belgium's Fondation Boghossian to Qilin. The claim describes file encryption and potential data exfiltration; the post says it cannot confirm the information.
Worldleaks claims it breached CIM, a Germany-based real estate and infrastructure investment firm, and used ransomware to encrypt systems and exfiltrate data. The article says the claim is unconfirmed.
Ransomware.live reports that Worldleaks claims to have compromised Sheraton Hotel in the US and threatens to exfiltrate and publicly release sensitive information unless a ransom is paid. The claim is unconfirmed.
A ransomware.live monitoring post attributes a claim naming the City of Meriden (meridenct[.]gov) to incransom. The post says the claim is unconfirmed; it lists publication on March 26 and discovery on March 27, 2026.
Chaos claims it conducted a ransomware attack against KDM P.O.P. Solutions Group. The monitoring post identifies an actor-source listing, but says the claim is unconfirmed.
A ransomware.live monitoring post attributes an unverified claim targeting Orient Petroleum Resources Plc to worldleaks. The group allegedly threatens data exposure or encryption; the post does not confirm the claim.
WorldLeaks claims it breached Leighton, encrypted core systems and exfiltrated sensitive project data, threatening to release the files unless ransom is paid. The post says the claim is unconfirmed.
Akira claims it will upload 10 GB of Axiomatic Technologies Corporation data, including employee documents and corporate files. The monitoring post says the claim is unconfirmed.
