Nova Claims It Stole Data from Vietnam-Based Provider VNSO
Ransomware.live reports that threat actor nova claims to have taken client data from Vietnam-based cloud and server provider VNSO. The alleged theft is unconfirmed.
Ransom Monitor
Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2807 articles
Kairos Claims LR Reed as a Ransomware Victim
A ransomware claim attributed to kairos names Australian business LR Reed as a victim. The monitoring post says the claim is unconfirmed; it provides no evidence of compromise or details about affected systems or data.
Qilin Claims Primeline Logistics in Ireland Was Targeted
Ransomware[.]live reports that Qilin claimed Primeline Logistics in Ireland as a victim, with a leak-site post dated July 22, 2026. The claim is unconfirmed.
BrainCipher Claims Ransomware Attack on windiam.com
BrainCipher claims it targeted windiam[.]com; the monitoring post lists the victim on the group's leak site, but says the claim is unconfirmed.
Qilin Claims P & A Construction as a Ransomware Target
Ransomware.live lists US construction company P & A Construction as a Qilin target, citing a post on the group's site dated July 22, 2026. The claim is unconfirmed, and no incident details are provided.
Akira Claims 10GB Data Theft from Kruse Construction
Akira claims it will publish about 10GB of data allegedly taken from Kruse Construction, including employee, project, contract, financial, and customer records. The claim is unconfirmed.
Krybit Claims Ransomware Incident at Vibonum Technologies
Ransomware.live reports a ransomware claim by krybit against Vibonum Technologies Private Limited in India. The post says the incident affected services and data, but notes the information is based on the group’s unconfirmed public claims.
Krybit Claims Delhi Heart & Lung Institute as a Ransomware Victim
Ransomware.live lists Delhi Heart & Lung Institute (DHLI) as a victim claimed by the Krybit group, citing a post on the group’s leak site dated July 22, 2026. The claim is unconfirmed.
Chaos Threatens to Publish 262 GB Dataset It Claims Was Taken from issvc.com
Chaos claims it compromised a 262 GB confidential dataset from issvc.com and threatens public release unless an agreement is reached. Ransomware.live says the claim is unconfirmed.
DragonForce Claims Ransomware Attack on Koshkaryan Law Group
ransomware.live reports that DragonForce claimed Koshkaryan Law Group as a victim. The article attributes the claim to the group’s leak-site post and says it could not confirm the information.
Anubis Threatens to Leak Data It Claims Was Stolen From Fairlife
Anubis listed Coca-Cola and Fairlife on its leak site, claiming it had locked servers and exfiltrated 1 TB of data. Coca-Cola had disclosed a ransomware-related Fairlife production suspension; the group’s theft claims remain unconfirmed.
Nova Claims Tèrra Aventura in Ransomware Listing
Ransomware.live reports an unverified claim by nova targeting Tèrra Aventura, an outdoor treasure-hunt app operator. The actor says it will provide proofs only after the company contacts support through recovery-file channels.
Qilin Claims RehaVital Gesundheitsservice GmbH as Ransomware Victim
Ransomware.live reports a Qilin claim naming Germany-based RehaVital Gesundheitsservice GmbH. The group reportedly claimed operational disruption and encrypted data; the report says it cannot confirm the claim.
Chaos Claims Data Theft from Argonaut Manufacturing Services
Ransomware.live says the Chaos group claims to have taken about 295 GB of Argonaut Manufacturing Services data and issued a 48-hour contact deadline. The post says the claim is unconfirmed.
Nova Claims Data Theft at La Financière d’Orion
Nova claims it stole about 20 GB of client documents and financial information from French wealth-services firm La Financière d’Orion. ransomware.live records the claim, which the article says is unconfirmed.
Nova Threatens to Leak Files It Claims Were Stolen from AHORA Entre Ríos
A ransomware.live listing names Canal 9 Litoral as a victim and nova as the actor. Nova claims files were stolen from news platform AHORA Entre Ríos and threatens to expose them; the claim is unconfirmed.
Nova Claims It Obtained Marpatech Data
Nova claims it accessed Marpatech data and provided a tree and samples after contacting the company’s support channel. The claim is unverified; the post lists Peru, Argentina and Colombia.
Play Ransomware Lists Kreysler & Associates in Unconfirmed Claim
A ransomware.live monitoring record says the Play group listed Kreysler & Associates, a US business services organization. The claim is unconfirmed.
Play Ransomware Group Claims Tax MT as a Victim
A ransomware.live monitoring post attributes a claim targeting Tax MT to the Play group. The post says files were encrypted and operations disrupted, but states the information comes from the group’s public claim and is unconfirmed.
Qilin Claims Evergreen Title as a Ransomware Victim
A ransomware.live monitoring post attributes a ransomware claim against Evergreen Title to Qilin. The post alleges file encryption and operational disruption, but says the group's claims are unconfirmed.
DragonForce Claims Release of One Community FCU Data
DragonForce allegedly released One Community FCU databases and internal documents, including client financial information and delinquent-payment records. The claim is unconfirmed; ransomware.live attributes it to the group’s leak-site post.
Settra Claims Extortion of Downies Collectables in Australia
Ransomware.live reports that actor settra claimed to extort Downies Collectables Pty Ltd, citing $1.4 million in monthly losses and $78,000 in rent paid to itself. The claims are unverified.
Akira Claims Novasport Compromise, Threatens to Publish 17 GB
Akira allegedly compromised Czech company Novasport s.r.o. and threatened to publish about 17 GB of corporate data, including employee, client, financial, project, and contract information. The claim is unconfirmed.
Ransomhouse Claims Nichirei as a Ransomware Victim
Ransomhouse is reported to have claimed Nichirei, a Japanese food and refrigerated-logistics company, as a ransomware victim. The claim and reported operational disruption are unconfirmed.