Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2800 articles
Ransomware.live reports an unconfirmed ransomware claim by actor unsafe against Constellation HomeBuilder Systems, with operational disruption and attempted data compromise reported but not independently verified.
Qilin claims a ransomware incident involving German solar energy company pm-energy Die Solarexperten. The monitoring post lists encryption and disruption, but says the group’s claims are unconfirmed.
Ransomware.live reports that Qilin claimed an incident involving Université Libre de Bruxelles, alleging file and service encryption and disruption. The claims are unconfirmed.
Ransomware.live reports that Qilin claimed to target Peru-based manufacturing company Grupo Diestra. The post is dated Aug. 9, 2026; the incident is unconfirmed.
A monitoring record attributes to Qilin a ransomware claim against Thai manufacturer Phithan Phanich, alleging data disruption and attempted extortion. The claim was published August 9, 2026, and is unconfirmed.
A ransomware.live monitoring post attributes a claim targeting Canadian manufacturer Service d’usinage 9002 to Qilin. The post describes possible encryption and service disruption but says the claims are unconfirmed.
A ransomware.live monitoring record attributes to Sovcali an unverified claim that it possesses Lucidmotors engineering files, including 5.078 TB of CATIA and STEP models and related analyses and reports.
A ransomware.live monitoring post attributes a ransomware claim against Thailand-based Siam Oil Product to Panzer. The post says the claim is based on the group’s public claims and that it cannot confirm their accuracy.
Ransomware.live lists studiotibaldi[.]it, associated with Rome-based Studio Associato Tibaldi, as a victim claimed by krybit. The claim is unverified; the post says it cannot confirm the information.
A ransomware[.]live record attributes a ransomware claim involving Nigerian media organization Daily Trust to Panzer. The post describes operational disruption but says the information is based on the group’s public claims and is unconfirmed.
A ransomware.live record attributes a ransomware attack and operational disruption at healthcare technology company Omnicell to Everest. The post says the claims are unconfirmed.
A ransomware.live monitoring post reports that Everest targeted Ingersoll Rand, a U.S. manufacturing company. The post attributes the claim to Everest and says it cannot confirm the information.
Ransomware[.]live lists Impact Centre Chrétien in Haiti as a Qilin ransomware victim, based on a public group claim. The post says the claim is unconfirmed.
Ransomware.live recorded a Qilin claim targeting Singapore-based CLLS Co Ltd. The post alleges file encryption and operational disruption, but says the claim is unconfirmed and gives no further impact details.
Qilin claims it targeted German manufacturer Clausing, encrypted files and demanded payment. The post is attributed to the ransomware group and monitored by ransomware[.]live; the claims are unconfirmed.
A ransomware claim attributed to Incransom names the Louisville Bar Association as a victim. The group’s claim of service disruption is unconfirmed; the post cites a leak-site disclosure and ransomware.live monitoring.
A ransomware.live monitoring post attributes an unconfirmed claim targeting Sawyer Savings Bank to Storm. The post does not independently verify the claim or reported operational impact.
A ransomware.live monitoring post attributes a ransomware claim against United Group of Companies to Storm. The claim is unconfirmed; the post provides no independent evidence of compromise.
Clop claims Mindray was targeted in a ransomware incident. The claim, recorded by ransomware[.]live, is unconfirmed; the article says it cannot verify the group's information.
A ransomware.live monitoring post says Clop listed CONTINENTAL.AERO as a victim. The post attributes the information to Clop’s leak site and says the claim is unconfirmed.
A ransomware.live monitoring record says Qilin claimed Depona in Sweden as a victim on August 7, 2026. The post attributes claims of file encryption and operational disruption to the group and says they are unconfirmed.
Ransomware.live reports a Qilin claim targeting Canada’s Nikan Awasisak Agency, alleging file encryption and business disruption. The post says the group’s claims have not been independently confirmed.
Ransomware.live lists John C Saunders, CPA, as a Qilin target, with alleged file encryption and business disruption. The post says the group’s claims are unconfirmed.
A ransomware.live monitoring post attributes to Qilin a claim that EISNER ZT GMBH in Austria was targeted, disrupting operations and encrypting files. The post says the claims are unconfirmed.
