Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2813 articles
Incransom reportedly claimed Aesthetic Surgical Images, an Omaha plastic surgery practice, in a ransomware disclosure. The post says its medical records are managed by Morgan Records Management; the claim is unconfirmed.
Ransomware[.]live lists LogiQuip as a target of thegentlemen. The post attributes the information to public claims by the group and says it cannot confirm their accuracy.
Ransomware[.]live reports that the thegentlemen group claimed Medic Rescue Services in Beaver County as a victim. The post does not confirm the claim or specify an affected country.
Ransomware.live lists Shamrock Holdings in a thegentlemen claim alleging compromise of Stanley Gold’s 2021–2026 inbox and sent-email records. The claim is unconfirmed.
Ransomware.live lists Ample Surveyor Services Limited (amplesurveyor[.]com) as a DragonForce victim, citing the group's public claim. The post is unconfirmed and provides no incident details.
Ransomware.live records a bravox claim involving Swiss accounting firm PB Fiduciaire SA, published July 7, 2026. The post alleges targeting of business operations and financial data; the claim is unconfirmed.
A ransomware.live-monitored post attributes to Akira a claim that it will publish 67 GB of data from Edge Solutions | Stone Ridge Payments, including employee information and business records. The claim is unconfirmed.
A ransomware[.]live monitoring post says DragonForce listed UK-based employment and benefits specialist Hive360 in a ransomware claim; the post says the claim is unconfirmed.
Ransomware.live records an AiLock claim involving Richmont Graduate University, discovered and published on July 7, 2026. The post says it cannot confirm the claim’s accuracy.
Ransomware.live lists Studio Sardano, a repair-services company in Riccione, Italy, as an AiLock target; the post says the claim could not be independently confirmed.
Safepay claims it targeted shw-fr[.]de in Germany and disrupted business operations, according to ransomware.live, which cites the group’s leak-site post. The claim is unconfirmed; no victim statement is included.
A ransomware.live monitoring post attributes a claim against lh-wohnverbund-wohnen-nrw[.]de to SafePay and links it to the group’s blog. The post says the claim is unconfirmed.
SafePay claims it targeted St Edward’s Catholic First School in Great Britain and says data was encrypted and availability affected. The monitoring post says the claims are unconfirmed.
Ransomware.live reports that Incransom claims to have compromised samberger24[.]de, a Munich medical-supply and sports-analysis business. The claim is unconfirmed.
The incransom ransomware group claims it targeted Brazilian automotive supplier Tecno Curva (tecnocurva[.]com[.]br) and disrupted operations. The monitoring post says the claim is unconfirmed.
SpaceBears reportedly claims it targeted Fitcrunch and says personal information, financial documents and other files were affected. The claim is unconfirmed.
SafePay's leak-site post names rtngmbh[.]de in Germany as a ransomware victim. The monitoring record says the claim is unconfirmed; compromise, disruption, and data impact are not independently verified.
Ransomware.live lists knobel-bau[.]de, a German construction company, as a SafePay ransomware claim, citing the group’s leak-site post dated July 6, 2026. The claim is unconfirmed.
A monitoring entry lists Caritas Koblenz in Germany as a SafePay ransomware claim, citing the group's blog. The post says the claim has not been independently confirmed.
Safepay claims it compromised bmiprojects.de in Germany and disrupted operations. The ransomware.live post cites the group’s leak-site listing and says the claims are unconfirmed.
SafePay claims it targeted matrixwebagency[.]com in a ransomware incident. The claim was monitored by ransomware[.]live and is unconfirmed; the post invites an official statement from the company.
A monitoring record says Qilin targeted US business Answer Precision Tool, allegedly encrypting files and demanding a ransom. The claim is attributed to the group and remains unconfirmed.
ransomware[.]live records an unverified Qilin claim that U.S. construction company Keystone Homes was targeted. The post cites a group source and says the information could not be independently confirmed.
A ransomware.live monitoring post attributes a ransomware claim targeting India-based Hansa Research Group Pvt. Ltd. to Morpheus. The post says operations were disrupted but notes the claim is unconfirmed.
