Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2773 articles
DragonForce allegedly published data from Dominican health administrator ARS Renacer, including medical, identity, financial and credential files. The monitoring post says it cannot verify the claim.
The ransomware group emperador claims it encrypted several thousand employee and client documents and an archive of photos at Alabama Woman’s Health Care. The claim has not been independently confirmed.
Ransomware group Orova claimed an incident involving India’s Siddhi Green Excellence Pvt. Ltd., with the record dated September 20, 2026. The publisher says it cannot confirm the claim.
AuditTeam claims it encrypted data at Italian organization st***co and demanded payment for decryption, with a threat of data theft. The report is based on the group’s public claims and has not been independently confirmed.
A ransomware.live record says AuditTeam claimed an attack on St. Petersburg heat-engineering firm TEK SPB, reporting disruption to its systems and services. The claim is unconfirmed.
The ransomware group emperador claims it exposed several thousand documents, including customer documents and employee data, from an Italian notary office. The claim has not been independently confirmed.
A ransomware group named bravox reportedly claimed an incident involving U.S. geomatics and GIS provider TOWILL. The post alleges service disruption but says the claim has not been confirmed.
A ransomware claim attributed to Nightspire names Hong Kong healthcare company Great Bay Bio. The claim is unconfirmed, the impacted data is unknown, and the company is investigating.
The ransomware group emperador claims it targeted Cassias MG Government in Brazil and exposed government credentials and personal, civil, and medical data. The publisher says the claims are unconfirmed.
Ransomware group N0n claims it has destructive control of Fanatics’ cloud data and has begun deleting files. The post lists affected data and a deadline, but says the claims are unconfirmed.
A ransomware.live post reports an unverified ShinyHunters claim dated September 19, 2026, demanding a very large, negotiable payment and urging the listed victim to make contact before time runs out.
Arcusmedia claims it targeted Brazil’s AKAZZO to disrupt operations and extort payment. The monitoring post lists claim dates and an onion source but says the allegations are unconfirmed.
A ransomware monitoring post says Arcusmedia claimed Schneider’s Computing & Websites Ltd. in Canada as a victim. The claim is unverified; a leak-site deadline is listed for September 26, 2026.
A ransomware.live monitoring post records ZaWoo’s claim targeting French organization ambpvc, with encrypted and compromised systems alleged. The post says the claims are unconfirmed and cites the group’s leak site at fyenuhkq3pfhnbpidj5jm2fl2lryxip4byhg6eozynrnlomu4szf
A ransomware.live record attributes a ransomware attack on France-based FRANCARETRAD to ZaWoo and reports encrypted or inaccessible data. The post says the claim is unconfirmed.
A ransomware.live record attributes an alleged ransomware incident affecting French energy company HEOLIS to ZaWoo, claiming operational disruption and data encryption. The post says the claims are unconfirmed and cites hxxp://fyenuhkq3pfhnbpidj5jm2fl2lryxip4byhg6eozynr
The ransomware group emperador claims it accessed Electrolux’s Azure database in Sweden and exfiltrated about 41 GB. It threatens to leak a password-protected archive unless paid; the report says the claims are unconfirmed.
A ransomware monitoring post lists Quy Nhon University in Vietnam as a Vexy Ransomware victim, with a discovery date of September 19, 2026. The post says the group’s claim is unconfirmed.
A ransomware.live post records an AuditTeam claim targeting Italian entity td***up, published September 19, 2026. The post says the claim has not been independently confirmed.
A ransomware claim attributed to cry0 names US law firm Young Injury Law. The monitoring post provides no incident details and says the claim has not been verified.
A ransomware.live post says the Play group claimed it encrypted data at Barrett Mahony Consulting Engineers in Ireland and demanded a ransom. The post says the claim could not be confirmed.
Ransomware.live reported a Play group claim targeting Inglewood Golf in Canada, published September 18, 2026. The post says the information is based on public claims and has not been confirmed by the organization.
A ransomware.live record says the Play group claimed an incident involving US manufacturer Vista Plastic Solutions. The claim was published and discovered on September 18, 2026; its accuracy is unconfirmed.
A ransomware.live record says LockBit5 claimed an attack on Chilean apparel provider Forus, alleging data encryption or exfiltration. The post says the claim is unconfirmed.
