Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2797 articles
ransomware.live records a Qilin claim targeting Italy-based G.M.A. GRANDI MARCHE AUTOMOBILI – S.R.L. The post alleges encryption and operational disruption, but the record says it cannot confirm the group’s claims.
Ransomware.live lists oligo[.]de as a victim claimed by the settra group, citing the group's leak post. The monitoring entry says the claim is unconfirmed; no independent evidence of compromise is provided.
A ransomware.live record attributes an unverified data-theft claim against Flowco (flowco-inc[.]com) to Settra. The claim lists payroll records and internal company documents.
ransomware.live lists FirstDigital.com as a settra ransomware victim, citing the actor’s leak page. The claim is unconfirmed.
A ransomware.live monitoring post attributes an unverified ransomware claim against US-based POWDR to the Settra actor. The post provides no independently confirmed incident details.
A ransomware.live record attributes an unverified ransomware claim against Xpress Tech to Panzer. The post alleges operational disruption, but provides no independent confirmation.
Ransomware[.]live records an unverified Orova claim targeting Ganzhou Xinye Craft Co., Ltd. The post alleges operational disruption in Hong Kong but says the claim has not been confirmed.
Ransomware.live lists advancedtaxsolutions[.]com as a Settra victim, citing the group’s leak site. The post says the claim’s accuracy cannot be confirmed.
The settra ransomware group claims Profinergy BV in the Netherlands lost control of thousands of files. ransomware[.]live says the post is based on the group's public claims and could not confirm them.
Ransomware.live lists QPC Global as a DragonForce ransomware claim, published Aug. 10, 2026. The post says it cannot confirm the claim.
Ransomware.live lists Tommer Construction as a Qilin ransomware claim. The post alleges encryption, disruption and a ransom demand, but the report says the claims are unconfirmed.
A ransomware.live monitoring post attributes an unconfirmed ransomware claim against Service Evaluation Concepts to Qilin. The post says the claim alleges systems were encrypted or disrupted and a ransom was demanded.
Direwolf claims it targeted Quironsalud, a Spanish healthcare organization. The claim is unconfirmed; the article says it is based on the ransomware group’s public claims.
Direwolf claims it targeted Statista GmbH in Germany. The monitoring post describes unauthorized access and service disruption but says the claims are unconfirmed; no official statement from Statista is included.
A ransomware.live monitoring record attributes an unverified ransomware claim against U.S. technology company Merge to direwolf. The claim was published on August 10, 2026; the article says it cannot confirm the information.
A ransomware.live monitoring post attributes a claim targeting Chat Jurídico, a Brazilian legal-services organization, to the Direwolf ransomware group. The claim is unconfirmed.
The aurora ransomware group claims it stole employee records, trade secrets, legal files and incident documents from Austrian retailer FREYWILLE. The claim is unconfirmed.
A ransomware.live monitoring post says the direwolf actor made a public ransomware claim involving Leafwell, a US healthcare organization. The claim is unconfirmed.
Ransomware.live lists Interim HealthCare (Oklahoma and Tulsa) as a Genesis ransomware victim and reports a claim of operational disruption. The post says the claim is unconfirmed and offers to share any official response.
Genesis allegedly targeted Consolidated Medical Practices of Memphis and claimed disruption to medical operations. The claim was listed on the group’s leak site and is unconfirmed.
Deadlock claims LT Group / Fortune Tobacco ignored extortion messages and says it will publish data. The post lists 14,836 files totaling 27 GB, including passports, bank statements, credentials and promissory notes. The claims are unverified.
Ransomware.live reports an Anubis claim involving U.S. manufacturer Cleaver-Brooks, discovered August 10, 2026. The post says the claim is unconfirmed.
A ransomware.live monitoring record attributes claims of encryption and extortion targeting BigSpark to direwolf. The group’s claims are unconfirmed; the record was published on August 10, 2026.
Ransomware.live reports that Genesis claims to have victimized Interim HealthCare, alleging it encrypted critical systems and disrupted operations. The article says the claim is unconfirmed.
