coinbasecartel Claims Ransomware Attack on RXPE Group
Ransomware.live lists an unverified coinbasecartel claim targeting China-based manufacturer RXPE Group; the article says the claim has not been confirmed.
Ransom Monitor
Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2788 articles
Coinbasecartel Claims Integrated Health Systems as Ransomware Victim
A monitoring record attributes an unconfirmed ransomware claim against Integrated Health Systems to Coinbasecartel; its introductory text alleges system and data disruption without independent verification.
ShinyHunters Threaten to Leak BOK Financial Data Unless Paid
A ransomware.live monitoring post says ShinyHunters gave BOK Financial until Aug. 24, 2026, to respond or face a threatened data leak and disruptive digital problems. The claims are unconfirmed.
ShinyHunters Issues Final Extortion Warning Naming NovoCure Limited
Ransomware.live reports that ShinyHunters issued NovoCure Limited a final warning on Aug. 22, demanding contact by Aug. 24 to avoid an alleged data leak and disruption. The claim is unconfirmed.
Emperador Claims Theft of 300GB From Vietnam Electricity (EVNHANOI)
The emperador ransomware group claims it stole over 300GB of data from Vietnam Electricity (EVNHANOI), including customer and account records. The post says the ransom price is negotiable; the claims are unconfirmed.
Pear ransomware group claims Mogren, Glessner & Ahrens, P.S. as a victim
Mogren, Glessner & Ahrens, P.S. was listed by the Pear ransomware group, according to a monitoring record. The claim is unconfirmed; the record gives a published date of Aug. 20, 2026, and a discovery date of Aug. 22.
LockBit 5 Claims Ransomware Incident Involving ICN
Ransomware.live lists ICN (Itaguaí Construções Navais S.A.) as a LockBit 5 claim, with a post dated Aug. 22, 2026. The entry says operations in Portugal were impacted but notes the group’s claims are unconfirmed.
Pear Claims Island Networks as a Ransomware Victim in Jamaica
Pear reportedly claims it targeted Jamaica-based Island Networks, which provides business internet, cybersecurity and home Wi-Fi services. The claim is unconfirmed.
Spacebears Claims Freelom Client Data Was Exposed
The spacebears group claims SQL data containing Freelom clients’ personal data was exposed. The monitoring post says the claim is unconfirmed; Freelom is a Czech ISP and IT provider.
SpaceBears Claims Holzmarkt Chemnitz as Ransomware Victim
Ransomware.live reports an unverified SpaceBears claim involving Holzmarkt Chemnitz. The group allegedly stole or encrypted employee and client information, financial documents, and a SQL database associated with holzmarkt-chemnitz[.]de.
thegentlemen Claims Meridian Logistics Group Data Theft
A ransomware claim monitored by ransomware.live says thegentlemen staged a network image and recovered ERP, dispatch, and payroll data from Meridian Logistics Group. The post says the claim is unconfirmed.
Termite Claims Everglades Boats as a Ransomware Victim
Ransomware.live reports that the termite group claimed Everglades Boats, a Florida boat manufacturer, as a victim. The post alleges system compromise and operational impact, but the claims are unconfirmed.
Rhysida Claims CRI Electric Data Theft
A ransomware monitoring record attributes an unverified Rhysida claim against CRI Electric, alleging theft of employee account artifacts, vendor tax forms, payroll, HR/legal correspondence, and financial and certification records.
Nightspire Claims Ransomware Incident at Victory Personal Care
A ransomware claim attributed to nightspire names Victory Personal Care, Inc. as the victim. The claim is unconfirmed, and details about affected data are unavailable; the record is monitored by ransomware[.]live.
Thegentlemen Claims UOLconsult as a Ransomware Victim
A ransomware.live monitoring post attributes an unconfirmed ransomware claim against UOLconsult in Brazil to thegentlemen. The post does not confirm the claim or report verified operational impact.
L Group Claims Cedarridge.org as Ransomware Victim
Ransomware.live lists cedarridge[.]org as a victim of L Group, citing the group’s post. The claim alleges encrypted files and operational disruption, but the report says it cannot confirm the information.
Qilin Claims Ransomware Attack on Blake Services
Ransomware.live lists Blake Services in the US as a Qilin ransomware claim; files were reportedly encrypted and operations disrupted, but the post says the claims are unconfirmed.
Qilin Claims The Pendas Law Firm Was Targeted in a Ransomware Incident
A ransomware.live monitoring record attributes a ransomware claim targeting The Pendas Law Firm to Qilin. The post says the claim is unconfirmed; disruption and potential encryption are not independently verified.
Qilin Claims Gindre India as a Ransomware Victim
Ransomware.live reports that Qilin claimed Gindre India as a victim on Aug. 21, 2026. The post attributes claims of file encryption and operational disruption to the group; the publisher says it could not confirm them.
Qilin Claims iPic as a Ransomware Victim
A ransomware.live monitoring post attributes an unverified claim naming US hospitality organization iPic to the Qilin ransomware group. The post links to a Qilin leak-site entry and says the information is unconfirmed.
Qilin Claims Quaker State Mexico Was Targeted in August 2026
A monitoring post attributes to Qilin a claim targeting Quaker State Mexico, discovered and published on August 21, 2026. The post says the claim is unconfirmed.
Panzer Claims Nteitalia Files in Ransomware Listing
Panzer’s ransomware listing claims it targeted Nteitalia, an engineering and telecommunications provider in Catanzaro, Italy, and compromised thousands of sensitive documents. The monitoring post says the claim is unconfirmed.
Rhysida Claims Access to Fairview Dental Group Patient Records
Rhysida's leak site listed Fairview Dental Group on Aug. 21, 2026, claiming access to patient records, X-rays, forms, consents and invoices. The claims are unverified.
Qilin Claims Ransomware Attack on Cinépolis in Mexico
Ransomware.live reports an unverified Qilin claim targeting Cinépolis in Mexico, alleging encryption and disruption to access to files and systems. The post says it cannot confirm the claim.