Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2817 articles
Stormous reportedly claims access to customer data, designs, orders, and other business assets associated with impulso-store[.]com and its parent company. The claim is unconfirmed and monitored by ransomware[.]live.
Stormous claims it accessed customer, buyer, design and order data associated with montechiaro-store[.]com and affected domains of its parent company. The claim is unconfirmed and monitored by ransomware[.]live.
Stormous claims it accessed customer and buyer data, designs, orders, and other assets tied to lorenzoni-store[.]com and associated parent-company domains. The post says the claim is unconfirmed and is monitored by ransomware[.]live.
Anubis reportedly claimed to have affected Quest Health Solutions, citing employee data and internal files. The claim is unconfirmed; the post says it is based on public claims monitored by ransomware.live.
Stormous claims it accessed and exfiltrated more than 400 GB from maglificioliliana[.]com, including designs, customer databases, financial records and employee files. The claim is unconfirmed; ransomware[.]live says it monitors the post.
Stormous claims to have compromised jaggroup[.]com and posted a full data dump allegedly containing credentials, Microsoft Dynamics GP databases, financial records, and internal business files. ransomware[.]live notes the claims are unconfirmed.
Stormous claims a 10GB data dump from mlit[.]com[.]my, allegedly containing internal financial records, corporate folders and network-share and remote-desktop directory structures. The claim is unconfirmed; ransomware.live says it is monitoring the post.
A ransomware.live monitoring record attributes a ransomware claim against Transvill SRL, a transport and logistics company, to nova. The post is based on public claims and says their accuracy is unconfirmed.
A ransomware.live monitoring record attributes an unconfirmed claim about Alejandria to the Nova actor. The claim alleges interference with the victim’s teleinformation systems and information architecture.
Ransomware.live lists an unconfirmed ransomware claim by nova against LP Group, with a purported data-profile sample. The post attributes the claim to the group and says it cannot confirm the information.
Akira reportedly claims it will exfiltrate Miami Machine data, including employee documents, contracts and client information. The claim is unconfirmed; ransomware.live monitored the listing.
Nova claims Transvill SRL, a Peru-based transportation and logistics company, as a ransomware victim. The claim is unconfirmed; the post says a data profile will be provided soon.
A ransomware.live record attributes to Akira an unconfirmed claim that it targeted Jit Ex and will publish 40 GB of corporate data, allegedly including employee and customer information.
The actor nova made an unverified claim targeting LP Group in Portugal, citing a compromised-data profile in a sample. The claim was listed on the actor’s site and monitored by ransomware[.]live.
Kazu claims to have stolen about 2.3 TB of SaludTools records and demands $400,000 by July 7, 2026. The claim is unverified, and SaludTools has not publicly confirmed it.
Kazu claims to have stolen 1.73 TB of data from Argentine telemedicine platform ConsultorioMovil and demands $200,000 by July 7, 2026. The claim is unverified; the company has not publicly responded.
Akira claims it accessed IH Engineers’ data and says it plans to upload 65 GB. The alleged material includes employee records and confidential business documents; the claims are unconfirmed.
Akira allegedly claims to have exfiltrated sensitive Leo International data and says it will upload 10 GB. The claim is unconfirmed; ransomware.live says the post is based on the group’s public claims.
A ransomware.live monitoring post attributes an unconfirmed ransomware campaign targeting Brazil’s gov[.]br government platform to APT73, citing the actor’s leak-site claim.
Ransomware.live lists an unverified APT73 claim that it compromised Indonesian retailer KliknKlik (kliknklik[.]com), allegedly disrupting access to data and systems. The post says it cannot confirm the claim.
ransomware.live reports an unconfirmed bravox claim involving Meta in Brazil. The claim concerns occupational health services and alleges service disruption; the article says it has not been independently confirmed.
A ransomware.live record attributes to Incransom a claim that it targeted Horizon Eye Care and deployed ransomware to disrupt operations. The article says the claim is unconfirmed.
Kazu allegedly claims to have stolen 3,197,677 Meducar patient records and demands $150,000 by July 9, 2026, threatening public release. The reported data includes personal and health-related information; the claim is unconfirmed.
Ransomware.live lists Coldstat Refrigeration as a claimed victim of cmdorganization. The post says the claim is based on public statements by the group and that it cannot confirm the information.
