Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2820 articles
A ransomware.live monitoring post attributes to Genesis a claim targeting the Associated Builders and Contractors of Indiana/Kentucky. The post alleges encrypted or disrupted data and services but says the claim is unconfirmed.
Ransomware.live lists United Personnel, a Masis Staffing Solutions division, as a Genesis ransomware claim. The post says the claim is unconfirmed; operational impact is not independently established.
SafePay claims it affected German manufacturer zaunsysteme[.]de; ransomware[.]live lists the claim, but says it could not confirm its accuracy.
Ransomware.live lists Harcourts (harcourts[.]net) as a Safepay ransomware claim published June 17, 2026. The article says the group's claims are unconfirmed.
Ransomware.live reports a SafePay claim against the Italian public utility identified as seinordovest[.]it, published June 17, 2026. The article says the claim is unconfirmed.
RansomHouse claims it targeted Prince George County, according to a ransomware.live monitoring post citing the group’s leak-site listing. The claim is unconfirmed; no compromise or service disruption is independently established.
A ransomware.live-monitored listing attributes a claim against Brazilian hospitality provider Chebib Control to SpaceBears. The group reportedly claims it encrypted SQL databases and exfiltrated client data; the information is unconfirmed.
Akira claims it exfiltrated about 10GB of Smith Filter data and plans to leak it, allegedly including employee IDs, financial details, client and project information, and NDAs. The claim is unconfirmed.
Akira allegedly claims it will publish 65GB of Insite Architects data, reportedly including employee personal documents, credit card information, and project, client, and partner details. The claim is unverified.
The krybit ransomware group claims it targeted Paraguayan manufacturer ERSA (ersa[.]com[.]py). ransomware.live listed the claim on June 17, 2026; the post says the information is unconfirmed.
Ransomware.live reports that krybit claimed to target Senegal’s Court of Auditors on June 17, 2026, allegedly to disrupt operations or extract data. The claim is unverified.
A ransomware.live monitoring record attributes an unconfirmed claim to Spacebears concerning Brazilian accounting firm Gerencial. The actor allegedly exposed digital certificates, client data and more than 600,000 files.
DragonForce claims it targeted Italian fastening-systems manufacturer Tecfi SpA and disrupted three production lines. The monitoring post says the claim is unconfirmed.
ShinyHunters claims it exposed more than 220GB of Ralph Lauren data, including customer and transaction information and unreleased products. The monitoring post says the claims are unconfirmed.
Aurora claims it exfiltrated 1.1 TB from Sumitomo Electric Bordnetze, including HR, payroll, engineering, and banking-related files across five sites. The monitoring post says the claim is unconfirmed.
A ransomware.live record attributes to aurora claims that Diamond Truck Centres’ data was exposed, including payroll, customer banking, biometric, immigration, credential and military-contract information. The claims are unconfirmed.
Ransomware.live reports an unconfirmed Aurora claim targeting Allan Brothers Fruit, alleging theft of employee, tax, banking, immigration, production-backup and operational records.
A ransomware.live record attributes a ransomware claim targeting Novo Nordisk to fulcrumsec, citing a source link. The claim is unconfirmed; the record lists June 16, 2026, as its publication and discovery date.
Ransomware.live lists Framesi Professional (framesiprofessional[.]com) as a victim claimed by Incransom, citing the group's disclosure page. The post says the claim is unverified; no incident impact is independently confirmed.
Ransomware[.]live reports that incransom listed Jasper Plastics Solutions as a victim. The group’s claim is unconfirmed; the article provides no independently verified impact.
A monitoring record attributes a ransomware claim against Argentine medical-device manufacturer Promepla to RansomHouse. The record says operations were affected, but the claim is unconfirmed.
The ransomware actor shadowbyt3$ claimed TINYpulse employee chats, names, email addresses and financial records were exposed, and threatened further releases. The claim is unconfirmed; ransomware.live monitored the listing.
A ransomware.live record attributes a claim that SafePay targeted kawaius[.]com in the US, threatening data exposure or service interruption to coerce payment. The claim is unconfirmed.
SpaceBears claims it stole about 2 TB of data from ECOVACS. The ransomware.live monitoring post says the claim is unconfirmed.
