Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2843 articles
A ransomware.live post attributes a ransomware claim involving Executive Aviation to the Play group. The post says operations were disrupted and critical systems encrypted, but notes the claims are unconfirmed.
A ransomware.live monitoring record attributes a claim naming Salag as a victim to Qilin. The claim is unconfirmed; the article provides no country or further incident details.
CoinbaseCartel claims it breached Geno Bank and threatens to leak or sell sensitive genetic data allegedly stored on GenoBank[.]io. The claim is unconfirmed and was monitored by ransomware[.]live.
Payload claims Royal Bahrain Hospital in Bahrain was targeted and its systems encrypted. The claim is unconfirmed; the post cites a Payload source and says it is monitored by ransomware.live.
ShinyHunters claims Aura Group, Inc. had over 2 million records containing PII and internal corporate data compromised, totaling about 12GB compressed. The claim, published March 15, 2026, is unconfirmed.
A ransomware claim attributed to coinbasecartel names nChroma Bio as a victim. The post cites a leak-site listing and ransomware.live monitoring, but says the claim is unconfirmed.
A ransomware[.]live record attributes an unverified ransomware claim against Augenomics to coinbasecartel and cites the group’s leak-site listing. The post says the claim’s accuracy is unconfirmed.
A ransomware.live monitoring post attributes to coinbasecartel a claim that data related to Illumina genetic studies was uploaded. The claim is unconfirmed; the article provides no independent evidence of compromise.
Ransomware.live reports that coinbasecartel added new samples to an ATG listing on March 15, 2026. The claim is unverified, and no official statement is included.
Ransomware.live lists U.S. supplier In.Sa.Cor as a payload ransomware claim, alleging operational disruption and possible system encryption. The post says the claim is unconfirmed.
A ransomware claim attributed to Payload targets Alcoholes Finos Dominicanos, S.A. The claim reportedly says the Dominican producer’s operations were affected; the article says it cannot confirm the claim.
The payload ransomware group listed Cairo-based Grid Fine Finishes on its leak site on March 14, 2026. The monitoring post says the claim is unconfirmed; it lists the victim’s country as GB while describing the company as Egyptian.
A monitoring record attributes a ransomware claim against Thai packaging company J.T. Pack of Foods to Payload. The record alleges operational disruption, but the information is unconfirmed.
ransomware.live records an unverified Lynx claim listing indrub[.]com as a victim and links to the actor’s leak page. The record labels the victim India, while its company description says it operates in Winnipeg.
The Beast ransomware group claims it compromised Communicate UK and is demanding a ransom to restore system access. The claim is unverified; the post cites the group’s leak-site listing and ransomware[.]live monitoring.
A ransomware claim attributed to Nightspire targets France-based CFTC Metallurgie. The monitoring post says incident data is unavailable and notes the claim has not been confirmed.
A ransomware claim attributed to beast alleges that Trinity Catholic High School was targeted, data was exfiltrated, and a ransom was demanded for decryption. The claim is unconfirmed.
A ransomware.live monitoring post attributes a ransomware claim about Duffy’s Sports Grill to Qilin. The claim is unconfirmed, and the post lists no details about impact or data exfiltration.
Killsec is listed as claiming Meena Health, a healthcare organization, as a ransomware victim. The monitoring post says the claim is unconfirmed and gives no ransom amount or payment method.
Ransomware.live lists Alarmco, a U.S. organization, in an unverified ransomware claim attributed to Qilin. The post gives no details on ransom, encryption, or affected data.
Anubis claims it breached KLA Laboratories and exfiltrated credentials, contracts, and infrastructure information. The monitoring post says the claims are unconfirmed.
Handala claims it breached Tamir Hayman’s mailbox and exposed 50,000 emails, described as “top secret,” while threatening publication. The post is based on the group’s public claim and is unverified.
The incransom ransomware group claims it targeted Integer Holdings (integer[.]net); the post cites the group's disclosure page but says the claim is unconfirmed. It lists publication on Nov. 10, 2025, and discovery on Mar. 13, 2026.
A ransomware.live-monitored post attributes to Akira a claim that it will publish 23 GB of Stokes Inc. data. The alleged data includes employee information, financial records, client information, contracts and confidential files; the claim is unverified.
