Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2791 articles
Ransomware[.]live lists Mexico-based Grupo DT as a victim of Everest, which allegedly claimed the incident on Aug. 20, 2026. The post says encryption and extortion were involved; the claim is unconfirmed.
Ransomware.live reports that Everest claimed to target French professional-services firm Experts Entreprendre; the post alleges encryption and business disruption, but says the claims are unconfirmed.
A ransomware.live monitoring record attributes a claim that Everest targeted Kingston Technology to the group’s leak site. The article says disruption occurred but notes the claim is unconfirmed.
A ransomware.live monitoring record attributes an unverified ransomware claim to Settra, naming GrecoSteel, a Greek manufacturer. The post alleges access to and encryption or probing of critical systems; the publisher says it cannot confirm the claims.
A ransomware.live record attributes claims of unauthorized access and encryption/exfiltration involving am-bition[.]jp and AMBITION Group materials to settra. The article says the claims are unverified.
Ransomware.live lists Target as a ransomware victim claimed by xpl0itrs. The article says the claim is unconfirmed and provides no independently verified details about the alleged incident.
Ransomware.live reports that Settra claims access to and potential exfiltration of internal documents from Alphanumeric Systems, Inc. The claim is unconfirmed.
Settra claims it encrypted West Coast Management and Realty documents, including more than 1,000 debt collection records with names. The claim is unverified and attributed to the actor’s leak site.
Ransomware.live lists Spanish media organization Semana as a Qilin ransomware target. The group reportedly claims encryption, operational disruption, and a ransom demand; the post says these claims are unconfirmed.
Ransomware[.]live says Deadlock publicly claimed an incident involving Turkey’s Global Terminal Services and 470 GB of data. The post also reports operational disruption, but says the claims are unconfirmed.
Ransomware.live lists United Fiber Optic Communication Inc. (UFOC) in Taiwan as a Deadlock ransomware victim. The post says operations were reportedly impacted, but the claim is unconfirmed.
Ransomware.live lists Delek US in a Helix ransomware claim; the post says the victim is “live” and describes tiered unlock timing. The site says the claim is unconfirmed.
Insomnia reportedly claimed Aurora Health Management, a U.S. skilled nursing and rehabilitation operator, as a victim. The claim is unverified; the article says it is based on the group’s public claims.
Akira reportedly claims it will publish 30GB of data allegedly taken from CPA firm Ericksen Krentel, including personal information and confidential business records. The claim is unconfirmed.
A ransomware.live monitoring post attributes an unconfirmed ransomware claim against Advanced Engineering Consultants to coinbasecartel, citing the group's leak site. The post says it cannot confirm the claim.
Ransomware.live reports that krybit claimed S.I.P.R.E.S. SRL, associated with sipresitalia[.]it, as a victim on Aug. 19, 2026. The alleged data compromise and disruption are unconfirmed.
Krybit claimed an attack on Argentine company Rosedal Automotores S.R.L. The claim is unverified; the article provides no independent confirmation of encryption, disruption, or data access.
Ransomware.live records an unverified krybit claim targeting the municipality of Jilemnice’s official website in Czechia. The post says local services were affected; no independent confirmation is provided.
Ransomware[.]live lists an unverified ransomware claim by thegentlemen targeting CRASL, an accounting firm in Suffolk, UK; the post says the actor allegedly aims to disrupt its operations.
Ransomware.live reported an unconfirmed ransomware claim by thegentlemen naming Italian manufacturer Euroscreen. The article provides no confirmed incident details and says the claim's accuracy could not be verified.
A ransomware claim attributed to threeam names MECASEM in Mexico as a victim. The claim was monitored by ransomware[.]live and is unconfirmed.
Ransomware.live lists Lifesum, a Swedish company, as a Dire Wolf ransomware target based on the group’s public claim. The claim is unconfirmed, and the article provides no independent evidence of compromise.
A ransomware.live monitoring post attributes a claim targeting financial software company PayUp to the DireWolf ransomware group. The post says the claim is unconfirmed.
A ransomware monitoring record names InfoFlo CRM as a Dire Wolf victim, citing a group-published claim dated Aug. 19, 2026. The claim of unauthorized access and service disruption is unconfirmed.
