Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2843 articles
DragonForce claims it compromised Warden Construction, a Jacksonville-based general contractor; ransomware.live says the claim is unconfirmed. The listing attributes the claim to DragonForce and dates it March 20, 2026.
A ransomware claim attributed to Kairos names Germany-based Resch Maschinenbau as a victim. The claim is unconfirmed; the article provides no evidence of encryption, data theft, or operational impact.
DragonForce claims an attack on South African insurer The Unlimited. The claim was listed on the group’s leak site and monitored by ransomware[.]live; the article says it could not verify the information.
DragonForce claims it encrypted Centre Concrete’s networks, exfiltrated data, and demanded payment. The claim is attributed to the group’s leak-site post and monitored by ransomware[.]live; it is unconfirmed.
Ransomware.live reports that DragonForce listed Liverpool Philharmonic Hall as a victim. The post says the claim is unverified and that its accuracy could not be confirmed.
DragonForce claims it compromised SoPower, an industrial electrical services provider. The claim is attributed to the group’s leak-site listing and monitored by ransomware[.]live; the article says it cannot confirm the claim.
A ransomware.live record says Chaos claims to have exfiltrated data from Smyth Companies (smythco[.]com) and threatens to disclose 1,000 GB unless a 24-hour settlement deadline is met. The claim is unconfirmed.
Ransomware.live recorded a payload claim naming TS Lines Philippines on March 20, 2026. The post says operations were affected, but the article says the claim has not been independently confirmed.
A ransomware claim naming WAL Consultant was attributed to Qilin and recorded by ransomware.live. The post says the claim is unconfirmed; no additional incident details are provided.
DragonForce claims it intruded on The Farese Group, encrypted systems, and exfiltrated client data. The firm is reportedly assessing the incident while continuing to serve clients; the claims are unconfirmed.
DragonForce claims it compromised Edifice Design + Architecture and threatens to encrypt data and leak sensitive client and design files unless a ransom is paid. The claim is unconfirmed.
Ransomware.live reports that Qilin claims to have compromised AGENCAVI SRL in Italy, exfiltrated data, and threatened publication unless a ransom is paid. The post says the claim is unconfirmed.
A ransomware.live monitoring record attributes a ransomware claim against France-based VirtualExpo Group to Qilin. The claim is unconfirmed; the attack vector and data impact are not publicly available.
Akira allegedly claimed a ransomware-style breach against Madesmart and threatened to upload 31GB of corporate data, reportedly including employee, HR, financial, client, contract and NDA files. The claim is unverified.
WorldLeaks claims it breached Taiwan-based Winmate Inc. and deployed ransomware against its industrial display and embedded automation systems. The claim is unconfirmed.
Dragonforce claims it intruded on Oriska Insurance and threatens to publish client data and disrupt claims processing unless a ransom is paid. The monitoring post says the claims are unconfirmed.
A ransomware[.]live monitoring post attributes to ShinyHunters an unverified claim that more than 5 million Berkadia Salesforce records and other corporate data were compromised. The group warns of a leak unless contacted by March 22, 2026.
Ransomware.live lists BITS Business Information Technology Solutions in Germany as a victim claimed by thegentlemen. The post says the claim is unverified and provides few technical details.
ransomware[.]live records an unverified dragonforce claim naming Mercedes-Benz of Arlington as a target. The claim alleges operational disruption, encryption, data exfiltration, and extortion; the post says it cannot confirm the claims.
A ransomware.live-monitored claim attributes an attack on Italian engineering services provider Tecnocad Group to coinbasecartel. The group reportedly claims project data was encrypted and operations disrupted; the post says it cannot confirm the claims.
Akira claims it will release 8 GB of Career Adventures data, including employee, HR, financial, and client information, unless a ransom is paid. The claim is unconfirmed and monitored by ransomware[.]live.
Akira claims it compromised The Decorative Paving Company and threatens to release 20 GB of data, reportedly including employee records, project documents, and financial records. The claim is unconfirmed.
Qilin claims a ransomware incident targeting Arca Service in Italy. The monitoring post attributes the claim to the group but says it is unconfirmed and provides few incident details.
Ransomware.live lists Austria's hollu Systemhygiene as a claimed Qilin ransomware victim, citing the group's public claim. Details about a ransom demand, encryption scope, and data impact are unavailable; the claim is unconfirmed.
