SafePay Claims Hellmold-Plank as a Ransomware Victim
SafePay claims hellmold-plank[.]de in Germany as a ransomware victim. The claim was published on the actor’s blog and listed by ransomware[.]live; the report says it could not confirm the claim.
Ransom Monitor
Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2816 articles
cmdorganization Claims Ransomware Activity Against Kohinoor Mills
A monitoring post attributes ransomware activity against Kohinoor Mills to cmdorganization. It says operations were disrupted but notes the claim is unconfirmed. The record lists India, while its narrative says Pakistan.
Nova Claims VSL Marine Technology in Ransomware Listing
The ransomware actor nova reportedly listed VSL Marine Technology Pvt. Ltd. of India as a victim on June 26, 2026. The article says the claim is unconfirmed.
AiLock Claims Hokua Suites as Ransomware Target
AiLock is reported to have claimed Hokua Suites as a target. The claim is unconfirmed; the record lists Chile, although it describes the property as being in Honolulu, Hawaii.
Chaos ransomware group claims Ingerman as a victim
Ransomware.live lists Ingerman as a Chaos ransomware claim dated June 26, 2026. The post is based on the group’s public claim; the report says it cannot confirm the information.
Payload Claims Ransomware Attack on Mosaic Partners
Ransomware.live reports that the actor Payload claimed Mosaic Partners, a Swiss IT services company, as a victim on June 26, 2026. The article says the claim is unconfirmed.
Dragonforce Claims Theft of Aptora and 100+ Client Databases; Aptora Reportedly Denies Leak
Dragonforce claims it took Aptora data and more than 100 client databases and may release the archives to pressure the company. Aptora reportedly denied a leak; the claims are unconfirmed.
Incransom Lists The Swanson Law Group in Unverified Ransomware Claim
Incransom listed theswansonlawgroup[.]com in a ransomware claim, according to a ransomware.live monitoring post dated June 26, 2026. The article says the claim is unconfirmed.
Incransom Claims Ransomware Incident at John Dufour Law Office
Ransomware.live lists an unverified Incransom claim naming the Law Office of John Dufour (johndufourlaw[.]com). The actor’s disclosure is cited as the source; alleged disruption and data exposure are not independently confirmed.
Incransom Claims Data Theft at Horton Personal Injury Lawyers
Incransom claims it compromised Horton Personal Injury Lawyers and stole confidential data. The claim was listed on the group's leak site and monitored by ransomware[.]live; the article says it could not confirm the claim.
Payload Claims Ransomware Incident at Software Arge
The payload ransomware group claims an incident involving Turkey-based Software Arge. The claim is associated with encryption and extortion, but the article says it has not been independently confirmed.
Play Ransomware Claims Attack on Benchmark Industrial Supply
Ransomware.live lists Benchmark Industrial Supply as a Play ransomware target, alleging disruption and system encryption. The post says the claims are unconfirmed and invites an official statement.
Payload Claims Ransomware Attack on Clínica La Sabana
The actor payload claims it attacked Bogotá healthcare provider Clínica La Sabana, allegedly affecting outpatient care, consultations, surgery and physical therapy. The claim is unverified and attributed to the actor’s leak-site post.
Akira Claims Exfiltration of 10GB From Precise Forms
Ransomware.live reports that Akira claims to have exfiltrated 10GB from Precise Forms and threatens publication, alleging the data includes employee IDs and SSNs, contracts, projects, and customer records. The claim is unconfirmed.
Nova Claims Ransomware Activity Against NSW Rural Fire Service
A ransomware.live record attributes a ransomware claim against NSW Rural Fire Service to Nova and says data was leaked. The post cites group claims and says the information could not be independently confirmed.
Interlock Claims Ransomware Attack on Clearview Eye Centre
Interlock reportedly claimed an attack on Calgary clinic Clearview Eye Centre and alleged exposure of medical, personal, incident, financial and tax information. The claims are unconfirmed.
Anubis Claims Nachlass Nord Data in Unverified Ransomware Listing
ransomware[.]live lists Nachlass Nord in Germany as an alleged Anubis ransomware victim, with claims involving IDs, estate records, and client data. The post says the group’s claims could not be confirmed.
Krybit Claims POLITUR/CESTUR as a Ransomware Victim
Ransomware.live records a June 25, 2026, ransomware claim by krybit targeting politur[.]gob[.]do, associated with Dominican Republic tourism police POLITUR/CESTUR. The claim is unconfirmed; no incident impact details are provided.
Nightspire Claims Grupo Riquelme Data in Unverified Ransomware Listing
A ransomware claim monitored by ransomware[.]live names Grupo Riquelme as the victim and nightspire as the actor. The post claims a full database backup and several categories of business data; the claims are unconfirmed.
Incransom Claims GSP Crop Science Pvt as a Ransomware Target
The incransom ransomware group claims it targeted GSP Crop Science Pvt, an Indian agricultural company. The record attributes the claim to the group’s disclosure page and says it is unconfirmed.
Incransom Claims Life Bridges as a Ransomware Victim
Ransomware.live monitored an Incransom claim naming Life Bridges, a US nonprofit providing residential support and healthcare. The claim was listed on June 25, 2026, and has not been independently confirmed.
Morpheus Ransomware Claim Lists Delegal Poindexter & Underkofler, P.A.
Ransomware[.]live lists Delegal Poindexter & Underkofler, P.A. in a Morpheus claim dated June 25, 2026. The post says the group’s claims are unconfirmed and provides no incident or data details.
Qilin Claims Ransomware Attack on Greece’s ISOPLUS
Qilin claims it targeted Greece-based ISOPLUS with ransomware, allegedly encrypting data and disrupting operations. The report says the claim is unconfirmed.
AuditTeam Claims I-SYS as a Ransomware Target
Ransomware.live lists I-SYS as an alleged AuditTeam ransomware target, with a claim of disruption to its digital-transformation services and core platforms. The post says the claim is unconfirmed.