Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2821 articles
The incransom ransomware group claimed it stole about 100 GB of data from Czech auditing and consulting firm FIZA, including client, financial, corporate and business records. The claim is unverified.
SpaceBears claims it stole employee and client information, financial documents, and more than 200,000 other files from Cattani in Italy. The claim is unverified.
Morpheus reportedly claims it targeted HDFC FUND in India and affected operations and access to critical data. The monitoring post says the claim is unconfirmed; it was discovered and published on June 10, 2026.
Worldleaks allegedly targeted Centra Sota Cooperative and claimed disruption to its operations. The report attributes the claim to the group’s leak site but says the information is unconfirmed.
Ransomware.live lists Tata Electronics as a worldleaks ransomware claim dated June 10, 2026, alleging impact to its manufacturing and precision-engineering operations. The post says the claim is unconfirmed.
A ransomware claim attributed to worldleaks names Indian manufacturer Apollo Pipes as a victim and says operations were impacted. The article says the claim is unconfirmed.
A ransomware.live monitoring post attributes a ransomware claim against German manufacturer Lösing Filtertechnik to SpaceBears. The post says access to systems was disrupted but states the claim could not be confirmed.
A ransomware-monitoring record attributes a claim against Singapore-based Global Schools Foundation to fulcrumsec. The post says the claim is unconfirmed.
Ransomware.live lists Auburn Electrical Construction Company as a victim claimed by the Embargo actor; the post alleges operational disruption, but the claim is attributed to the group and is not independently confirmed.
Ransomware.live lists Mid-Cumberland Human Resource Agency as a target claimed by Insomnia. The post says the claim is unconfirmed; no compromise or data impact is independently established.
PrinzEugen claims it encrypted hundreds of GB of data on Spratley’s company file shares and says a decryption key is available upon request. The monitoring post says the claim is unconfirmed.
Ransomware.live reports an unverified ShinyHunters claim targeting the University of Nottingham. The group allegedly exposed billing, payment and student finance data, including information from its Malaysia and China operations.
PrinzEugen claims hundreds of GBs of data across Spratley’s of Mortimer’s company file shares were encrypted and says a decryption key is available on request. The claim is unconfirmed.
A monitoring record attributes an unconfirmed claim to Akira targeting Rockaway River Country Club in New Jersey. The group reportedly threatens to publish about 25GB of corporate data, including employee documents, financial records, contracts, project files and client
Akira allegedly claimed it targeted Spray Equipment & Service Center and threatened to upload about 26 GB of corporate data. The post says the claim is unconfirmed.
A ransomware claim attributed to the Chaos group names US managed services provider AireSpring. The post cites a leak-site listing and is monitored by ransomware[.]live; the claim is unconfirmed.
Stormous claims it extracted 150 GB of data from sa2000[.]com, including financial, customer, supplier, employee, shareholder, and email records. The claim is unverified; the company’s response is awaited.
Stormous is attributed with claiming it exfiltrated over 10 GB from katholiekamersfoort[.]nl, including databases, personal information and internal documents. The claim is unconfirmed.
Akira allegedly claims it will publish 142 GB of Centre Ellipse Strasbourg data, reportedly including health records for at least 500 patients. The claim is unconfirmed and monitored by ransomware[.]live.
A ransomware.live monitoring record attributes a ransomware claim concerning Cambridge Law Chambers to gunra. The post says the claim is based on public statements by the group and has not been confirmed.
Ransomware.live lists an unconfirmed Nightspire claim targeting ASIA STRATEGIC, a business services organization. The post says data is unavailable and gives no country or independent incident evidence.
ransomware.live records a Qilin ransomware claim naming US telecommunications company SatCom CX, dated June 8, 2026. The post says the claim is unconfirmed; no official statement is provided.
A ransomware.live record attributes a ransomware claim against Australian healthcare organization The Banyans Health and Wellness to Qilin. The alleged encryption or data access, ransom demand, and operational impact are unconfirmed.
A ransomware.live record attributes to TERMITE a claim targeting Roland Machinery (AU), alleging malware was deployed to disrupt operations. The claim is unconfirmed.
