Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2807 articles
Ransomware.live lists Switzerland’s Stiftung Autismuslink as a victim claimed by incransom. The group reportedly claimed operational disruption, but the article says the claim is unconfirmed; the impact is not independently verified.
Ransomware.live reports that the Nova actor claims to have targeted Digital Edge (SG), alleging encryption and theft of sensitive reports and client data. The claims are unconfirmed.
Incransom claims it targeted Cabin Creek Health Systems in West Virginia and disrupted operations. The claim is unconfirmed; ransomware.live says it is monitoring the report.
Ransomware.live lists The DeBruler as a U.S. victim in a claim attributed to the Play group, published July 23, 2026. Possible operational impact and encryption are mentioned, but the post says the claim is unconfirmed.
A ransomware.live monitoring post attributes a claim targeting Restaurant Depot to the Play group. The post says files were encrypted and restaurant operations disrupted, but notes the claims are unconfirmed.
Ransomware.live listed Record Go Alquiler in Argentina as a Play ransomware victim, citing claims of system access disruption and encrypted data. The post says the claims are unconfirmed.
A monitoring record attributes to KillSec a claim that it targeted India-based Origins IVF, encrypted files and demanded payment. No public payment or data release is confirmed; the report says the claim could not be verified.
Ransomware.live reported an unconfirmed Killsec claim naming Bulwark Exterminating as a victim on July 23, 2026. No disclosure details were provided.
Ransomware.live lists CashCowboy in the US in a KillSec claim dated July 23, 2026. The post alleges file encryption and a payment demand, but says the claim is unconfirmed; no disclosure details were indicated.
A ransomware.live listing attributes a ransomware claim against Germany’s Menlo Systems to settra. The article says the claim is based on the group’s public statements and is unconfirmed.
ransomware.live reports an unverified settra ransomware claim naming royalchain.com, with a leak-site listing and a reference to archive delivery. The article says it cannot confirm the claim.
A ransomware.live monitoring post attributes to NightSpire a claim that Auto Royal Company in Italy was attacked and more than 100GB of SQLInfinity database data was exposed. The claim is unconfirmed.
TheGentlemen reportedly claims to have exposed more than 800 GB of Disney Family/Shamrock Holdings data. Ransomware.live attributes the claim to the group; the post says it cannot confirm the information.
A ransomware.live-monitored record attributes a ransomware victim claim naming Portuguese manufacturer Sirl to thegentlemen. The post says the claim lists impacted operations but does not confirm the incident.
Qilin claims it targeted UK healthcare organization WellPerf, alleging file encryption and operational disruption. The monitoring post says the claims are unconfirmed.
Ransomware.live records an unconfirmed ransomware claim by m3rx naming UB Freight. The post provides no impact details or information about stolen data.
Ransomware.live lists Infina Health as a Qilin ransomware claim, alleging file encryption and operational disruption. The post says the information comes from the group's public claim and is unconfirmed.
A ransomware.live monitoring post attributes a ransomware claim against Sunway Berhad in Malaysia to Qilin, with the claim listed on July 23, 2026. The post says the claim is unconfirmed.
Ransomware.live lists EFU Life Assurance in Pakistan as a Qilin ransomware claim dated July 22, 2026. The post says the claim is unconfirmed; no official statement from the insurer is included.
Qilin claims it compromised Cpcg in Brazil and demanded payment. ransomware.live attributes the report to the group's public post and says the claim has not been independently confirmed.
Chaos claims it published a 3% sample from a 627 GB Neopharmlabs.com archive and demands contact within 48 hours, threatening further exposure. The claim is unconfirmed and was monitored by ransomware[.]live.
ransomware.live reports a Qilin ransomware claim targeting Salida Union School District. The post says access to files and systems was disrupted, but notes the group’s claims have not been confirmed.
Ransomware.live lists Recsa in Costa Rica as a Qilin ransomware claim, discovered and published July 22, 2026. The post says it is based on the group's public claims and has not been independently confirmed.
A ransomware claim attributed to blacknevas names Zuni Shopping Center, Inc. The post says the claim may involve its retail and tourism businesses, but notes the information is unconfirmed.
