Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2789 articles
Akira claims it breached JC Sales and threatens to publish 206 GB of data, reportedly including employee, financial, and client information. The claim is unconfirmed and monitored by ransomware.live.
Ransomware.live lists First Commerce LLC as a claimed pear ransomware victim, with alleged file encryption and operational disruption. The post says the group’s claims are unconfirmed.
A ransomware.live monitoring record lists Clifton Architectural Glass & Metal under the actor pear. The record cites a source listing, but the information is unconfirmed.
A Rhysida leak-site listing claims data from Battle Creek Public Schools, including student, federal funds and staff health-spending records. The claim is unconfirmed.
A ransomware.live record attributes a claim against Hogan Omidi P.C. to DragonForce. The post reportedly alleges disruption to legal operations and case management; the information is unconfirmed.
Ransomware.live lists Aztec Software in Mexico as a Dire Wolf target, with claimed file encryption affecting its engineering software operations. The post says the claims are unconfirmed.
Ransomware[.]live lists NorthStar, a Canada-based ERP organization, as a Direwolf victim. The post attributes claims of operational disruption and encrypted business data to the ransomware group; the information is unconfirmed.
Ransomware.live reported an Anubis claim of a data breach at Interim HealthCare’s U.S. headquarters, discovered and published on August 21, 2026. The claim is unconfirmed.
The actor payload claims it stole data from Qualiflex Datacenter and several Swiss organizations. The claim is attributed to the actor but remains unconfirmed by the article.
A ransomware claim attributed to Kairos names the Ayuntamiento de Velilla de San Antonio in Spain. The claim is unconfirmed; the post says it is monitored by ransomware[.]live.
A ransomware.live record attributes to xpl0itrs a claim targeting Gruppo Spaggiari Parma and disrupting access to school administration systems. The post says the claim is unconfirmed.
Ransomware[.]live lists the University of Delhi as a DYSPHOR1A ransomware-claim victim. The post says the claim is unconfirmed and alleges impacts to access to data and services across academic and administrative operations.
Ransomware.live lists Latoplast, a manufacturing organization in Latvia, as a Play ransomware victim. The group's claims, including possible disruption and data access, are unconfirmed; the article also mentions Canada without explaining the connection.
A ransomware[.]live monitoring record attributes a claim against U.S. technology organization Be Media to the Play group. The post alleges encryption and disruption but says the claim is unconfirmed.
ransomware[.]live records a ransomware claim by emperador naming NetExam as the victim. The claim is unconfirmed; the article says it cannot verify the group’s information.
DYSPHOR1A allegedly claimed access to records of 52,000 Indonesian police officers, including personal details, passwords, location information and 4,000 facial photographs. The claim, monitored by ransomware[.]live, is unconfirmed.
Ransomware.live lists an unconfirmed DYSPHOR1A claim that GUSTO College GLMS user accounts and Moodle credentials were compromised. The article provides no official confirmation.
DYSPHOR1A claims it leaked data from AYUDHYA TH Insurance, including admin credentials and information about an internal batch-control system. The monitoring post says the claim is unconfirmed.
Ransomware.live lists U.S. Bank as a LockBit 5 ransomware claim dated Aug. 20, 2026. The post attributes the claim to the group and says it cannot confirm the information.
The Titan ransomware group claims it attacked Italy-based ELCON MEGARAD S.p.A. and caused operational disruption. The post cites the group’s blog and says the claim is unconfirmed.
Ransomware.live lists Austin Plastic Surgery Institute as a victim claimed by the pear actor, citing the actor’s leak site. The post says the claim is unconfirmed.
Ransomware.live lists makfreight[.]com and M.A.K. Freight Systems as a Settra ransomware victim, citing the group’s leak site. The post describes the company as Canada-based but labels the victim country Malaysia, and says the claim is unconfirmed.
A ransomware.live monitoring record lists Capgemini Engineering as an Everest ransomware claim, published August 20, 2026. The post says the claim is unconfirmed.
A ransomware.live monitoring post attributes a targeting claim against JP Molyneux Studio Ltd to Deadlock. The post says the actors threatened disruption but states the claim is unconfirmed.
