Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2818 articles
A ransomware.live monitoring record attributes claims of encryption and operational disruption at Brazilian real estate firm Coemi Imóveis to Krybit. The claims are unconfirmed.
The ransomware group krybit claimed it targeted MUPRAS RAM (www[.]mupras[.]com), alleging service disruption and data encryption. The claim is unconfirmed and was monitored by ransomware.live.
Krybit claims it infiltrated AASA CP Holding Company (AASA Group), headquartered in Dubai; ransomware[.]live listed the claim on June 19, 2026. The claim is unconfirmed.
BrainCipher claims it targeted themintgaming[.]com, encrypted critical files and disrupted system access; ransomware.live's monitoring post says the group's claims are unconfirmed.
A ransomware.live post attributes to Stormous a claim that 10GB of data was leaked from MLIT.com.my, including financial records and files allegedly extracted from internal shares and remote desktop sessions. The claim is unconfirmed.
A ransomware.live monitoring post attributes a ransomware claim involving Sparkle Pools to Qilin. The post says the information is unconfirmed; specific impact details are not provided.
A ransomware.live monitoring post attributes an unconfirmed ransomware attack claim against Germany’s Roth Industries to Qilin; the post says it cannot verify the group’s claims.
Ransomware group pear claims Optimum First Mortgage was affected by an incident that disrupted access to systems supporting its U.S. mortgage operations. The post cites the group’s company listing; the claim is unconfirmed.
A ransomware.live monitoring post attributes a claim against Chilean company ATCOM Outsourcing to Qilin, alleging encrypted systems and operational disruption. The post says the claims are unconfirmed.
Ransomware.live recorded a Qilin claim naming US construction company Homes By J Anthony. The claim was listed on June 18, 2026; the post says it could not confirm the information.
A monitoring post attributes a ransomware claim targeting LegendsMN (Blue Ox, Paul Bunyan, Lumberjack Electric) in the US to nightspire. The claim is unconfirmed, and details about the data are unavailable.
Ransomware.live monitors an unconfirmed cloak claim that ra-vogeler[.]de in Germany was targeted and involved 1.1TB of private data. The article says it cannot confirm the claim.
Ransomware.live reports that Qilin claimed THL PROJECT MANAGEMENT SDN. BHD. in Malaysia as a victim. The post mentions encrypted files and disrupted operations, but says the group's claims are unconfirmed.
Ransomware.live lists Makel Companies Group in Turkey as a Qilin ransomware victim; the post attributes the claim to the group and says it could not independently confirm it.
Ransomware[.]live lists Lawson Roofing as a Rhysida victim and repeats claims of encrypted files and disrupted operations. The post says the claims are unconfirmed.
Ransomware.live reports that ShinyHunters claimed icsecurity[.]com suffered compromise of more than 2.7 million records and other internal data, demanding contact by June 22, 2026, or threatening a leak. The claim is unconfirmed.
Ransomware.live reports that Lynx listed www[.]someco[.]com, associated with Southern Mechanical Contractors, on June 18, 2026. The post alleges operational disruption, but the claim is unconfirmed.
Akira reportedly claimed it would upload 12GB of Apptricity data, allegedly including employee identity documents, source code, project files and agreements. The claim is unconfirmed.
A ransomware.live monitoring post attributes to Akira an unverified claim that it stole 50 GB of data from Berg Lilly, including personal, medical, financial, and legal records, and plans to upload it.
Incransom claims it stole data from German municipal housing provider NEUWOGES (neuwoges[.]de). The monitoring post also alleges continued IT cost-cutting after the attack; the claims are unverified.
Incransom claims it exfiltrated 7 TB of Horizon Family Medical Group data, including patient and business records. The claim is unconfirmed; the article says it cannot verify the actor’s allegations.
A ransomware.live-monitored post attributes an unverified claim to ShinyHunters: more than 3.1TB of data was taken from NAIC[.]org, with a threatened leak unless the organization contacts the group by June 22, 2026.
ShinyHunters claimed Amazon-owned OneMedical[.]com had over 8.8 TB of data compromised and demanded contact by June 22, 2026, threatening a leak and further disruption. The claim is unverified.
A ransomware claim attributed to Lynx names Wolf Construction Services, Inc., a US construction company. The claim is listed on Lynx’s leak site and monitored by ransomware.live; the article says it cannot confirm the information.
