Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2804 articles
A ransomware-monitoring post attributes a claim of 10 GB of data theft from Oklahoma Manufacturing Alliance to Booba Project. The post says the claim is based on public statements by the group and is unconfirmed.
Deadlock claimed to have targeted Italian metal-alloy heat-treatment company Pasello Trattamenti Termici Srl. The claim is attributed to ransomware.live monitoring and is unconfirmed.
A ransomware.live monitoring record attributes a claim involving Spanish biopharmaceutical company DIATER to Deadlock. The post says the claim is unconfirmed; it provides no independent evidence of compromise or impact.
Ransomware.live reports that Booba Project claimed to have stolen 25 GB of data from Incredible Technologies. The post says the claim is unconfirmed and offers to share any official statement from the organization.
A ransomware.live monitoring post attributes an unverified victim claim for Italian biotech firm Takis srl to Deadlock. The article provides no independent confirmation or technical incident evidence.
Incransom claimed it compromised eclmn[.]com, described as a Minnesota family-run health and residential care organization. The claim was listed on the group’s disclosure page and monitored by ransomware[.]live; it remains unconfirmed.
SafePay's leak-site post claims Landesmuseum[.]de in Germany was targeted; ransomware[.]live lists the claim. The claim is unconfirmed, and the article provides no incident details.
Ransomware.live reported an Anubis claim of a client-data breach at French mortgage brokerage franchise Prelys Courtage. The post says the claim is unconfirmed.
A ransomware.live record attributes a claim involving Argentina-based Gran Valle Negocios to Qilin. The post says disruption and encrypted data were claimed but states the information has not been independently confirmed.
incransom listed Foundations to Freedom (foundationstofreedom[.]org), a Florida nonprofit, in a ransomware disclosure dated July 28, 2026. ransomware[.]live says the claim is unconfirmed.
A monitoring record says the incransom group listed Greene County, Georgia, on July 28, 2026. The claim is attributed to the group and described as unconfirmed; no incident or impact details are provided.
Ransomware.live listed Katathani Phuket Beach Resort in Thailand as a DragonForce claim on July 27, 2026; the post says the information comes from the group and is unconfirmed.
Ransomware group incransom claims it accessed DUCON’s confidential files, including client data, proprietary R&D and financial documentation. The monitoring post says the claim is unverified.
A ransomware.live record attributes to incransom a claim of unauthorized access to Minigrip’s confidential files, including client data, R&D and financial documents. The claim is unconfirmed.
Ransomware.live lists Affinia Healthcare as a victim claimed by the Termite actor, with a July 28, 2026 listing. The post says the claim is unconfirmed; alleged operational disruption is not independently verified.
Ransomware.live lists haugbuersten[.]de as a SafePay claim, citing the group's post. The claim is unconfirmed; the article provides no independent evidence or official statement from the victim.
Anubis claimed unauthorized access to systems and data affecting Coca-Cola’s Fairlife operations in the United States. The claim was listed on the group’s leak site and monitored by ransomware.live; it remains unconfirmed.
The ransomware group termite claims JD Young’s document workflow services and related offerings were disrupted in China. The monitoring post says the claim is unconfirmed.
A ransomware.live post attributes a claim targeting paritaet-nrw[.]org to SafePay. The post says the organization reported disruption, but states the group’s claims are unconfirmed.
Safepay claims moebelmayer[.]de in Germany as a ransomware victim, according to a listing attributed to the group and monitored by ransomware[.]live. The claim is unconfirmed.
Ransomware.live lists Zinorm.de in Germany as a Safepay ransomware claim, citing the group’s leak-site post. The article says the claim is unconfirmed; alleged operational disruption is not independently verified.
A ransomware.live monitoring post attributes an unconfirmed claim to nightspire targeting MKS Transformator in Turkey, with alleged access to business, HR, and production documents. The post says the claim has not been independently confirmed.
Ransomware.live attributes to Nightspire a claim that it targeted Thai Seng International Co. Ltd and encrypted administrative documents and marketing data containing client information; the post says it cannot confirm the claim.
A ransomware.live monitoring post attributes to Nightspire an unconfirmed claim that Akribis Systems Pte Ltd’s CAD files and employee, HR, legal, compliance, and machine data were stolen and encrypted.
