Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2793 articles
A ransomware-monitoring post attributes a claim targeting Swedish games company Wishfully Studios to direwolf. The post mentions operational disruption and potential data exposure but says the claims are unconfirmed.
Ransomware.live reports an unconfirmed Direwolf claim targeting Arizona State University. The article says the claim was published on August 17, 2026, and notes that its accuracy has not been confirmed.
Aurora claims it exfiltrated 268 GB of data from Planungsgruppe M+M AG, including financial, banking, document, email and payroll records. The claim is attributed to the group and remains unconfirmed.
Ransomware.live lists Doimo Cucine as a Panzer ransomware claim, citing the group’s onion page. The post says the claim is unconfirmed; it provides no independent evidence of operational impact.
ransomware.live records Panzer’s claim targeting Spain’s Castilla-La Mancha government and alleges disruption to public services; the post says the claims are unconfirmed.
A ransomware.live record attributes an unconfirmed ransomware claim against Brazil’s Vermont XCenter to DragonForce. The claim alleges impacts to the company’s contact center and technology systems.
Ransomware.live records an incransom claim naming Otter Tail County, Minnesota. The post says it is based on the group’s public claims, which the author could not independently confirm.
The aurora ransomware group reportedly claimed an incident involving Lloyd Coils Europe. The monitoring post says manufacturing and OEM customer support were affected, but notes the claim is unconfirmed.
Ransomware.live lists Twal Family IT Lab as a MedusaLocker victim, alleging impact to a personal home lab using VMware vSphere and multiple Active Directory domains. The post says the claim is unconfirmed.
Ransomware.live lists an unconfirmed settra claim that tiltstudio[.]com’s corporate archives were compromised and data leaked. The post cites settra’s leak-site listing; it provides no independent confirmation.
Ransomware.live reports that Settra claimed internal documents belonging to airoyal[.]biz, described as an American industrial components distributor, were exposed and threatened for release. The claim is unconfirmed.
Settra reportedly claims GALMACK S.A., an Ecuadorian auto dealership, as a ransomware victim and says internal documents, including monthly business records, were taken. The claim is unconfirmed.
A ransomware.live monitoring record attributes a claim against UK kitchen solutions provider Moores to bravox, alleging compromised files and a ransom demand. The claims are unconfirmed.
Ransomware.live recorded a Qilin claim targeting Belgian retailer WEBA Meubelen. The post alleges file encryption and operational disruption, but the article says the claims are unconfirmed.
A ransomware.live monitoring post says Qilin listed US hospitality company Spoonful of Comfort on August 16, 2026. The post says the claim is unconfirmed; the company’s response is not provided.
Ransomware.live reports an unverified Qilin claim targeting Coface in Italy, alleging unauthorized access and encryption affecting IT systems and business operations. The post says it cannot confirm the group's claims.
AGUNSA, a transportation company in Chile, was listed by Qilin as a ransomware victim. The report is based on the group’s public claim, which the monitoring post says it cannot independently confirm.
Ransomware.live lists Teikoku USA as a Qilin ransomware claim dated Aug. 16, 2026. The post alleges file encryption and operational disruption, but says the group’s claims are unconfirmed.
Qilin’s ransomware claim against Italy’s Mulino Padano was listed on the group’s leak site and monitored by ransomware[.]live. The post says the claim is unconfirmed.
A ransomware.live record attributes an unconfirmed ransomware claim naming maritime marketplace Moscord to the Eclipse group and links to the group's leak site.
Ransomware group Panzer lists Czech engineering firm SAGASTA sro as a victim, according to ransomware[.]live monitoring. The claim is unconfirmed, and the article provides no independent evidence of compromise or operational impact.
Ransomware.live reports a Qilin claim targeting Philippine company Megawide. The post says operations were disrupted, but states the group's claims have not been independently confirmed.
Qilin reportedly claimed an attack on German technology firm INVENSITY. The post says systems were disrupted and data encrypted, but notes that the group's claims are unconfirmed.
A ransomware.live record attributes a claim of ransomware activity against MOSAID Technologies in Canada to Qilin. The post says disruption and encryption were claimed but notes the information is unconfirmed.
