Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2773 articles
A ransomware.live post attributes an alleged attack on HyGear to LockBit5 and says operations were disrupted. The post cites the group’s claim but says it could not confirm the information.
A ransomware.live post records Panzer’s claim involving K3G Solutions Brazil and reports operational disruption. The post says the group’s claims could not be confirmed.
A ransomware.live record reports that Anubis claimed to target Quest Group and encrypt employee data and internal files. The claim’s accuracy is unconfirmed.
AuditTeam allegedly targeted Japan’s kit-e[.]jp. The post reports no data breach and says the ransomware group’s claim could not be confirmed.
Ransomware.live records a Gammax claim naming U.S. manufacturer Premier Lighting & Controls, published September 18, 2026. The article says it cannot confirm the claim.
Ransomware group N0n claims it compromised Venezuelan ISP Inter, stole subscriber records and internal network information, and severed traffic until settlement. The claims are unconfirmed.
A ransomware.live monitoring post records Incransom’s claim involving Kendall Hunt Publishing, dated September 18, 2026. The publisher says it cannot confirm the claim’s accuracy.
The ransomware group incransom claims it targeted Dutch tour operator Roan Luxury Camping Holidays. The claim was recorded on September 18, 2026, and the post says it could not verify the information.
Akira claims it exfiltrated about 9GB of Anderson Industries data, including employee and client information, project files, and financial records. The monitoring post says the claims are unconfirmed.
Ransomware group krybit claims it compromised data linked to Diakoniewerk Apolda gGmbH in Germany. The monitored claim was published September 17, 2026; its accuracy is unconfirmed.
A ransomware.live post records krybit’s claim involving harputyapi[.]com, a Turkish real estate and construction company. The post says the claim is unconfirmed.
A ransomware monitoring post attributes a claim involving the redacted company C… to SilentRansomGroup. The company name is pending disclosure, and the publisher says it cannot confirm the claim.
BrainCipher claims it compromised hoyletanner[.]com, a UK professional-services site, and encrypted or stole data. The monitoring post was published Sept. 17, 2026; the claim is unverified.
Ransomware group Chaos claims it began publicly releasing material related to expresspros[.]com after Express Employment Professionals representatives reportedly did not respond. The claim is unverified.
Ransomware.live records a Qilin claim targeting Invincible GG, discovered and published on September 17, 2026. The post says the claim is based on the group’s public statements and cannot be independently confirmed.
AuditTeam allegedly targeted South Korean education institution dg.ac.kr, claiming systems were encrypted and operations disrupted. The report says no data exfiltration was confirmed and notes the claim is unverified.
AuditTeam claims it compromised systems linked to buben[.]it and issued extortion demands. The ransomware.live post identifies buben in Russia and says the claims are unconfirmed.
A ransomware.live monitoring post says shinyhunters allegedly threatened to publish information about Qi**** unless negotiations proceed by 18 Sep 2026. The claim is unverified.
A ransomware.live post says BlackNevas claimed to steal and encrypt about 9.3 TB of Optimum First Mortgage data. The post says the claims are unconfirmed.
A ransomware group identified as emperador reportedly claimed an attack on Italian automaker RDA MOTORS S.P.A., alleging 7.3 GB of customer documents and employee data were compromised. The claim is unverified.
ShadowByt3$ claims it locked out HandyTrac Greystar AZ, possesses sensitive business and employee data, and is extending negotiations to September 22. The monitoring post says the claims are unconfirmed.
A ransomware.live record says AuditTeam targeted Kyiv-based Wise IT and disrupted its IT services. The post attributes the information to the group’s public claims and says it could not confirm their accuracy.
AuditTeam claimed it compromised Russian retailer palletshop and exfiltrated sensitive information. The monitoring post says the claim has not been independently confirmed.
A ransomware.live record says actor emperador claimed SEVENOAKS s.r.o. in the Czech Republic, listing 3.3 GB. The record states the claim’s accuracy could not be confirmed.
