Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2843 articles
Insomnia claimed a ransomware incident against Valley Family Health Care, a US community health center. The claim is attributed to the group’s listing and monitored by ransomware.live; the article says it is unconfirmed.
A ransomware claim attributed to spacebears lists Bonheure as a victim. The post describes the company’s karaoke, restaurant, real estate and internet cafe businesses, but says the claim has not been independently confirmed.
DragonForce claims it encrypted critical project data at Germany’s Hartmann Bau GmbH and demanded a ransom, allegedly disrupting project workflows. The post cites the group’s leak-site claim; no independent confirmation is provided.
Ransomware.live lists Flexform, an Italian furniture company, as a victim in a ransomware claim attributed to dragonforce. The claim is unconfirmed; the record cites a post on the actor’s leak site.
Sinobi listed Amerinational Management Services (AMS), a US provider of business services for martial arts schools, as a ransomware victim. The claim is unconfirmed.
A ransomware.live monitoring record attributes a leak-site claim against Elgi Electric & Industries to Sinobi. The post says the claim is unconfirmed; it provides no independently verified incident details.
DragonForce claims Construction Equipment Parts, LLC was compromised and threatens to leak sensitive data or disrupt systems unless a ransom is paid. The monitoring post says the claim is unconfirmed.
DragonForce claims it breached gasteiger.design and stole client data and project files, threatening public release unless a ransom is paid. The claim is unconfirmed.
A ransomware claim against Dynex/Rivett is attributed to DragonForce in a leak-site listing monitored by ransomware.live. The claim is unverified; the article says it cannot confirm its accuracy.
A ransomware.live record attributes an unverified ransomware claim against Delta Manufacturing to Interlock. The claim alleges exposure of customer and employee data, contracts, accounting records, and invoices.
A ransomware.live-monitored record attributes a claim to Chaos naming loopcap[.]com, but the article calls it a fictional scenario and says the information is unconfirmed.
DragonForce claims it attacked Conrad Capital Management and alleges customers’ personal and financial data were exposed. The claim is unverified; the article cites the group’s leak site and ransomware.live monitoring.
A monitoring record reports an unverified Qilin claim that BTX Global Logistics in the United States was breached; no further incident details are available.
Ransomware.live reports that thegentlemen claimed Vexin Normand in France as a victim on March 18, 2026. The claim is unconfirmed; the article provides no evidence of compromise or data theft.
A ransomware claim attributed to Killsec names hospitalvetdiadema24h[.]com[.]br in Brazil. The monitoring post says the claim is unconfirmed; it reports 0/1 disclosures.
Sinobi listed Interpack Northwest, Summa Energy, Teco, McAfee Tool & Die, and Eco Sound Builders as alleged victims, claiming network encryption and access. Screenshots reportedly show internal files, financial records, and system configurations.
A ransomware.live monitoring post attributes to Exitium a claim that approximately 400 GB of data was exfiltrated from Fannin CAD. The claim is unconfirmed.
SilentRansomGroup reportedly listed Wood Smith Henning & Berman LLP as a ransomware target. The monitoring post says the claim is unconfirmed.
Ransomware.live lists Interpack Northwest as a Sinobi ransomware victim. The post claims the incident disrupted operations but states that the claim is unverified.
A ransomware claim attributed to Sinobi names Summa Energy Fuel Services as a victim. The post cites a leak-site listing, but says the claim has not been independently confirmed.
Medusa claimed attacks on the University of Mississippi Medical Center and Passaic County. The hospital was offline for nine days, and the county reported disrupted phone and IT systems. Medusa demanded ransoms and threatened a data leak.
Ransomware.live lists Tiefenbacher Group as a Safepay victim. The group allegedly encrypted or exfiltrated data and threatened public disclosure; the post says the claim is unconfirmed.
Safepay claims it compromised brookercg[.]com, a Chattanooga-based construction management company. The claim is attributed to Safepay’s blog and monitored by ransomware[.]live; it remains unconfirmed.
Ransomware.live lists U.S. manufacturer McAfee Tool & Die as a sinobi ransomware victim, citing the group’s leak-site post dated March 17, 2026. The claim is unverified, and the article says it cannot confirm its accuracy.
