Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2806 articles
Ransomware.live reports that ShinyHunters claims BH Security, LLC was compromised, involving over 4.9 million Salesforce records containing some PII. The group threatens to leak the data unless contacted by July 30, 2026.
Ransomware.live lists Katathani Phuket Beach Resort as a DragonForce victim. The post alleges operational disruption, but the resort’s involvement and the claimed impact are unconfirmed.
A ransomware.live monitoring record attributes to ExfilSquad an unconfirmed claim that it targeted Wesco International and exfiltrated about 2.6 million records containing customer and employee information.
Global Secret Group claims Park Manufacturing Corp. was affected by a ransomware incident and lists 195 GB of data across 411,109 files and 48,413 folders. The claim is unconfirmed; the article cites the group’s source and ransomware.live monitoring.
Ransomware.live lists takethehop[.]com, operated by Hill Country Transit District, as a target claimed by Incransom; the article's assertion of service disruption is unconfirmed.
Ransomware.live reports that Global Secret Group claimed Pro-Tuff | Decals was targeted, alleging disruption and exposure of 412 GB across 589,623 files and 40,081 folders. The claim is unconfirmed.
Ransomware.live lists Contacto Garantido in Mexico as a Qilin ransomware claim, alleging file encryption and operational disruption. The post says it cannot independently confirm the group's claims.
ransomware.live records a Chaos claim targeting Remco.ca, discovered July 26, 2026. The article attributes claims of system compromise and encryption to the ransomware group; they are unconfirmed.
The m3rx ransomware group claimed to target servicebypremier[.]com, identified as a commercial HVAC and refrigeration company serving South Florida. The claim is unconfirmed.
A ransomware.live record attributes a ransomware claim against CreateInfor (createinfor[.]pt) in Portugal to m3rx. The claim is unconfirmed, and no stolen data is specified.
m3rx claims it stole 215 GB across 226,961 files from hydraulic-components[.]net, a German manufacturing victim. The claim is linked to the actor's leak site and monitored by ransomware[.]live; it is unverified.
A ransomware.live monitoring post attributes a claim targeting Swedish transport and logistics company Carrier AB to Deadlock. The post says the claim was discovered July 25, 2026, and notes it could not confirm the information.
Deadlock claimed an attack on Relesa, targeting the digital platform and client portal of Reginald Lee SA, a Coca-Cola distributor in Argentina. The report is based on the group’s claim and is unconfirmed.
Deadlock claims it targeted BioResearch, a clinical research center in Warsaw, Poland. The post is based on the group’s public claim; the incident has not been independently confirmed.
Ransomware.live lists an unconfirmed Deadlock ransomware claim against Kenya National Highways Authority (KeNHA), dated July 25, 2026. The article does not independently verify compromise or disruption.
A ransomware.live record says Deadlock claimed KEMEK, a Baltic manufacturing company, as a victim and alleged data encryption or exfiltration. The claim is unconfirmed.
A ransomware.live record attributes a 100 GB data-leak claim against Turkish manufacturer iw steelTEC to Doommageddon. The post says the claim is unconfirmed and lists no specific files.
Deadlock claims it stole more than 880 GB of sensitive internal data from Turkish manufacturer HIDROMEK. The claim is attributed to the group’s leak site and monitored by ransomware.live; the information is unconfirmed.
Deadlock allegedly listed Swiss IP firm Schaad, Balass, Menzl and Partner AG as a ransomware target. ransomware.live attributes the claim to the group; the post says it cannot confirm the information.
A ransomware.live monitoring post attributes a ransomware claim against Health Law Advocates to incransom. The post reports service disruption, but says the group’s claims are unconfirmed.
The ransomware group thegentlemen publicly claimed an incident involving Mexico’s Advanced Marketing. The monitoring post says the claim is unconfirmed; it provides no details about affected systems or data.
A ransomware[.]live monitoring record attributes a ransomware claim against US road-safety company A&A Safety to bravox. The post says the claim is based on the group’s public statements and is unconfirmed.
Blackwater claims it published customer, contract, and internal data allegedly stolen from Brazilian target msgas[.]com[.]br. The post says the claim is unconfirmed.
Ransomware.live records a public Kairos claim targeting U.S. aluminum-extrusion manufacturer Thermalex Inc. The post says U.S. operations were affected, but the claim is unconfirmed.
