Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2843 articles
DragonForce claims it attacked U.S. luxury eyewear retailer Edward Beiner. The claim is attributed to the group’s onion post and monitored by ransomware[.]live; the article says it cannot confirm the claim.
Akira claims it exfiltrated 60 GB of Frontier Technologies data, including project files, financial documents, and contracts, and threatens to publish it. The claim is unconfirmed and attributed to public claims monitored by ransomware.live.
The Gentlemen listed Groupe Courtois Automobiles, STS Travel, and Durable Superior Casters on its extortion portal, claiming it exfiltrated data and threatening to leak files. The claims are unconfirmed.
A ransomware[.]live monitoring post records an unconfirmed Anubis claim of a ransomware data breach affecting French IT company Scalian. It says Scalian reported a breach but cannot confirm the group's claim.
A monitoring post attributes a ransomware claim naming U.S. law firm Schlam Stone & Dolan LLP to Anubis. The post says the claim is unconfirmed and provides no independent evidence of the alleged incident.
ShinyHunters claim they operated BreachForums version 5 after the FBI seizure and threaten to leak its backups, including messages, emails, IP addresses, and posts. The claims are unconfirmed.
A ransomware claim attributed to crypto24 names South Korea’s ActionPower as the victim and alleges file encryption with potential data exfiltration. The article says the claim is unconfirmed.
A ransomware.live monitoring post attributes an attack claim against Durable Superior Casters, Inc. to DragonForce, including alleged system encryption. The post says the claim is unconfirmed.
Lynx claims njpcs[.]org was targeted and says patient data was accessed and clinical operations disrupted. The claim is attributed to the group and monitored by ransomware.live; the publisher says it cannot verify the information.
A ransomware monitoring post attributes to Play claims that TPIS Industrial Services’ systems were encrypted and data may have been exfiltrated. The post says the claims are unconfirmed.
Ransomware.live lists Mac Interiors in Ireland as a Qilin ransomware claim, dated March 26, 2026. The post says the claim is unconfirmed and lists incident details as N/A.
A ransomware-monitoring post attributes an unconfirmed claim against Slovakia’s Living in green, s. r. o. to Qilin, alleging data encryption and a ransom demand.
InterLock claims it breached Goodwill Industries of North Central Pennsylvania and exfiltrated 80 GB of data, including employee and partner personal information and financial records. The article provides no independent confirmation.
DragonForce claims it stole data from Pride Solvents, Kalima Resort & Spa, and SSP Airport Gastronomiegesellschaft mbH. The group alleges the largest haul was 716.5 GB from SSP; the claims are unverified.
A ransomware.live-monitored post attributes to ShinyHunters a claim that several terabytes of ZenBusiness data were taken from Snowflake, Mixpanel, Salesforce and related services. The group issued a deadline of March 30, 2026; the claim is unconfirmed.
A ransomware.live monitoring record attributes a claim involving Eastex Environmental Laboratory to nightspire. The post lists experimental reports, internal documents, and financial and HR documents; the claims are unconfirmed.
A ransomware claim attributed to nightspire names Taiwan-based Anbogen Therapeutics Inc. The post says the claim is unconfirmed and that breach-impact information is unavailable.
Incransom claimed Glenmark Pharmaceuticals as a ransomware victim. The claim is attributed to the actor’s disclosure page and monitored by ransomware[.]live; the article says it cannot confirm the claim.
Ransomware.live lists PULPDENT Corporation (pulpdent[.]com) as an alleged incransom victim, citing the group's disclosure. The post mentions potential operational disruption but provides no confirmation; its author says the claim cannot be verified.
ALP-001 claims it compromised Esprinet and stole 1.2TB of storage, setting an April 4, 2026 deadline. The monitoring post says the claims are unconfirmed.
Ransomware[.]live lists Capital Wholesale Drug as a Play ransomware claim, alleging file encryption and possible data exfiltration. The post says the claim is unconfirmed.
The ransomware actor payload claims Vancompare Insurance in the UK as a victim. The monitoring post says the claim was published on March 25, 2026, but states it cannot confirm the information.
Play claims it targeted U.S. financial services firm Ascent Asset Group, encrypted files and demanded a ransom. The post says impact and possible data exfiltration are still being assessed; the claims are unconfirmed.
Ransomware.live records an unconfirmed Play ransomware claim naming Pinnacle as a victim in the United States. The post says it cannot verify the claim.
