TheGentlemen Claims Mutant as a Ransomware Victim
A ransomware.live record lists Mutant as a victim claimed by thegentlemen, with discovery and publication dates of September 7, 2026. The source says the claim is unverified.
Ransom Monitor
Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2779 articles
Rhysida Claims SAD’S Interim Data, Including Payroll and Banking Records
A ransomware.live monitoring post attributes a claim involving SAD’S Interim to Rhysida. The group reportedly listed payroll, banking, identity, and employment records; the post says the claims are unconfirmed.
BlackNevas Claims to Have Encrypted Files at Turkish MEFA-Linked Companies
BlackNevas claims it encrypted files at companies in Turkey’s MEFA industrial ecosystem and demanded payment. The post says the group’s claims have not been confirmed.
Thegentlemen Claims to Have Stolen 100GB of Data from Argentine Pharmaceutical Company
Ransomware group thegentlemen reportedly claimed to steal about 100GB of data from Argentine pharmaceutical company Drogueria Saporiti Sacifia; the claim has not been confirmed.
AuditTeam Claims Ransomware Attack on pa***op in Russia
Ransomware.live reported an AuditTeam claim targeting pa***op in Russia, with file encryption and a decryption payment demand. The post says the group’s claims could not be confirmed.
Thegentlemen claims Hollard Insurance Group as a ransomware target
A ransomware.live monitoring post attributes a claim targeting South Africa’s Hollard Insurance Group to thegentlemen, recorded September 7, 2026. The post says the claim is unverified and gives no details of data theft, encryption, or operational impact.
Dark Project Claims to Have Stolen 340 GB of Data from MEI Architects
Dark Project claims it stole 340 GB of data, including personal information and architectural drawings, from MEI Architects. The claim is unverified.
Direwolf Claims Ransomware Attack on Colombia’s TrainMe
A ransomware-monitoring post reports that direwolf claimed an attack on Colombia-based TrainMe, a corporate wellness provider. The post says the claim could not be independently confirmed.
Rhysida Claims to Have Stolen Sensitive Data from Rug & Home
A Rhysida ransomware-group claim lists customer, employee, supplier, financial, and HR data allegedly taken from Rug & Home. The post says the claims have not been verified.
Direwolf Claims Ransomware Attack on Precision Vehicle Logistics
A ransomware.live monitoring post records Direwolf’s claim targeting U.S. transportation company Precision Vehicle Logistics. The post says the claim has not been independently confirmed.
Aurora Claims Benshaw, Inc. Data in Ransomware Leak
A ransomware.live monitoring post records an aurora claim involving Benshaw, Inc. The group allegedly exposed employee, payment, banking, payroll, and customer files; the post says it cannot confirm the claims.
Aurora Claims Theft of Sensitive Data from Jinny Beauty Supply
Aurora claims it stole credentials, payment-card forms, employee records, and business databases from Jinny Beauty Supply. The monitoring post says the group's claims have not been confirmed.
Direwolf Claims Ransomware Attack on HR Software Provider Lightcast
Ransomware group direwolf claims it targeted US-based HR software provider Lightcast, affecting operations and data availability. The report says the claim has not been independently confirmed.
Qilin Claims Attack on Complete Packaging Solutions
Ransomware.live recorded a Qilin claim targeting Complete Packaging Solutions, with the claim published and discovered on September 4, 2026. The post says the group’s claims could not be confirmed.
Qilin Claims Jouvet SAS as Ransomware Victim in France
A ransomware.live monitoring post says the Qilin group claimed Jouvet SAS in France as a victim and reports file encryption and operational disruption. The claim has not been independently confirmed.
ShinyHunters Issues Final Extortion Warning to Medela
Ransomware.live reports that ShinyHunters issued Medela.com a final warning on September 7, 2026, demanding contact by September 8 to avert an alleged data leak and further disruption. The claim is unverified.
ShadowByt3$ Threatens to Leak Allegedly Stolen Ben Leeds Properties Data
A ransomware group calling itself ShadowByt3$ claims it emailed Ben Leeds Properties and threatens to publish allegedly stolen data unless the company responds by September 9, 2026. The claim is unconfirmed.
Direwolf Claims Ransomware Attack on eAssist Dental Solutions
A ransomware.live post records direwolf’s claim of an incident affecting US healthcare provider eAssist Dental Solutions. The post says the claim is unconfirmed.
DYSPHOR1A Claims 1.08 GB Data Dump from Myanmar Transport Agency
DYSPHOR1A claims it exfiltrated a 1.08 GB database from Myanmar's RTAD government portal. The claim was recorded on September 6, 2026, and has not been independently confirmed.
DragonForce Claims Norwood Law Firm as a Ransomware Victim
A ransomware.live monitoring post attributes a ransomware victim claim involving Tulsa-based Norwood Law Firm to DragonForce. The post cites a group blog and says the claim could not be confirmed.
DragonForce Claims Ransomware Attack on Homewood Sales
Ransomware.live listed Homewood Sales as a DragonForce ransomware victim, citing a group post published September 4, 2026. The claim is unverified, and the company’s response is not provided.
DragonForce Claims It Leaked RubberMill Data, Including Employee and Engineering Files
DragonForce allegedly leaked more than 340 GB of RubberMill data, including credentials, email archives, SSNs, payment records and engineering files. The post says the group’s claims could not be confirmed.
Chaos ransomware group claims Evergenbio.com as a victim
A ransomware.live record says the Chaos group claimed to target Evergenbio.com, a US healthcare-sector company. The claim is unverified; no specific data theft, encryption, or operational impact is confirmed.
Vexy Ransomware Claims Sancity as a Victim in September 2026
A ransomware.live monitoring post records Vexy Ransomware’s claim naming Sancity as a victim, published and discovered on September 6, 2026. The post says the claim is unverified.