Qilin Claims Ransomware Attack on Busscar de Colombia
Qilin reportedly claimed an attack on Busscar de Colombia, with alleged disruption to access to files and systems. The monitoring post says the claim is unconfirmed.
Ransom Monitor
Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2809 articles
Qilin Claims Ransomware Attack on Cemoi in France
A ransomware.live monitoring post attributes a claim involving Cemoi in France to Qilin. The post says systems were disrupted and files encrypted, but states the claims are unconfirmed.
DragonForce Claims Data Theft and Encryption at Momenta
DragonForce claims it stole source code, financial and configuration files, and employee data from Momenta (momenta[.]cn), and encrypted servers and workstations. The post also alleges concealment; the claims are unconfirmed.
Qilin Claims Ransomware Attack on Czech Victim Jakub A.S.
A monitoring post records Qilin's claim targeting Jakub A.S. in the Czech Republic. The group alleges files were encrypted and access disrupted; the post says the claims are unconfirmed.
Qilin Claims to Have Compromised Centro Científico e Cultural de Macau
Qilin allegedly compromised Centro Científico e Cultural de Macau in Portugal and encrypted or stole sensitive data to extort payment. The monitoring post says the claim is unconfirmed.
Qilin Claims Counts & Dobyns as a Ransomware Victim
Qilin listed Counts & Dobyns, a US business-services organization, as a ransomware victim. ransomware[.]live says the claim is based on the group’s public statements and is unconfirmed.
Akira Claims It Will Publish 17 GB of Transworld Signs Data
Ransomware.live records an Akira claim targeting Canada-based Transworld Signs and threatening to publish about 17 GB of corporate data, allegedly including employee details, project files, financials, client information, and contracts. The claims are unconfirmed.
Safepay Claims Ransomware Attack on shuttlemeadowcc.com
Safepay claimed an attack on shuttlemeadowcc[.]com, identified as a U.S. private golf club. The report says the claim is unconfirmed.
Qilin Claims TitanTV, Inc. as a Ransomware Victim
A ransomware.live monitoring record attributes a ransomware claim involving TitanTV, Inc. to Qilin. The post says the group claimed the incident, but the information is unconfirmed.
DragonForce Claims Attack on Argentine Law Firm Nicholson y Cano Abogados
A ransomware.live monitoring post dated July 13, 2026, attributes an attack claim against Argentine law firm Nicholson y Cano Abogados to DragonForce. The post says the claim is unconfirmed.
Nightspire Claims Access to Webosphere SQL Database and Source Code
Nightspire reportedly claimed access to Webosphere’s SQL database and source code. The ransomware.live post says the claim is unconfirmed.
DragonForce Claims Ransomware Attack on Northeast Rescue Systems
A ransomware[.]live monitoring record says DragonForce claimed Northeast Rescue Systems was affected by ransomware activity and reports operational disruption. The claim is unconfirmed, and no victim statement is provided.
D1R Claims Access to ARM Through 2FA Bypass
D1R claims it used leaked Synopsys information and cross-referenced leaks to access ARM, then used Athena Download Manager to bypass some 2FA checks. The claims are unconfirmed and monitored by ransomware.live.
D1R Claims Bosch CAN Module Data Was Exposed
D1R claims it found and is sharing Bosch CAN module implementation data after analyzing leaks and cross-referencing targets. The report is monitored by ransomware.live and says the claim is unconfirmed.
Spacebears Claims Turbosoft in Cameroon as a Ransomware Target
Spacebears claims Turbosoft in Cameroon was targeted and threatens to expose employee and client personal information, financial documents, and other files. The claim is unconfirmed.
cmdorganization Claims Els for Autism as a Ransomware Target
A ransomware.live monitoring record attributes an unconfirmed ransomware claim targeting Els for Autism to cmdorganization. The record gives a July 12, 2026, publication date but provides no confirmed incident details.
Anubis Claims Exposure of Community Advocates Clients’ Personal Data
Ransomware.live lists Community Advocates as a victim of Anubis and reports the group’s claim that law firm clients’ personal data was exposed. The claim is unconfirmed.
Anubis Claims Surtifamiliar Employees’ Passports Were Exposed
Ransomware.live reports an Anubis claim targeting supermarket chain Surtifamiliar and alleging that employee passports were exposed. The claim is unconfirmed; the article says the affected country is unknown.
Anubis Claims Casper Orthopedics Patient Data Exposure
Anubis claims it exposed Casper Orthopedics patients’ data and medical records. The monitoring post says the claim is unconfirmed.
DragonForce Claims Ransomware Attack on Romania’s STEP Oiltools
Ransomware.live records a dragonforce claim involving Romania-based STEP Oiltools, including claimed disruption to operations. The post says the information is unconfirmed.
DragonForce Claim Names Al-Saidi Factory
A ransomware.live monitoring record attributes a public ransomware claim concerning Al-Saidi Factory to DragonForce and links to the group’s post. The record says it cannot confirm the claim.
Deadlock Claims Aldaco Avance 2022 S.L. as a Ransomware Victim
Deadlock reportedly claimed Aldaco Avance 2022 S.L., a Spanish industrial engineering and construction materials company, as a victim. The monitoring post says the claim is unconfirmed.
m3rx Claims Data Theft from WRT World Enterprises
A ransomware.live monitoring post attributes an unverified claim to m3rx alleging 377 GB across 267,891 files was stolen from WRT World Enterprises (wrtworld[.]com).
m3rx Claims 860 GB Data Theft from Forecon Inc.
A ransomware.live monitoring post attributes an unverified claim to m3rx that it stole 860 GB across 437,048 files from Forecon Inc. (foreconinc[.]com).