Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2822 articles
A ransomware.live monitoring post attributes a ransomware claim against Family Medical Associates of Raleigh to Genesis. The claim is unconfirmed, and the post provides no official statement from the organization.
Ransomware[.]live lists PB White & Co as a claimed Genesis ransomware target and cites a Genesis source. The monitoring post says it cannot confirm the claim.
Akira claims it targeted Cherokee Distributing Co and threatens to publish 40GB of corporate data, allegedly including employee documents and financial records. The claim is unconfirmed and monitored by ransomware.live.
Incransom claims it exposed about 500 GB of Colina Financial Advisors data, including client, financial, legal and compliance records. The claim is unconfirmed.
Ransomware.live reports that the nitrogen group claimed Pyramid, a U.S. shopping-center operator, as a victim. The claim allegedly affects ownership and management operations but is unconfirmed.
Ransomware.live lists Germany’s Geske Haus- und Versorgungstechnik GmbH as a Spacebears ransomware claim, alleging exposure of employee and client personal information and other company files. The post says it cannot verify the claims.
Akira claims to have accessed 13 GB of data from Sunrise Company and related entities, including personal, financial and client information. The claim is unconfirmed and monitored by ransomware.live.
Ransomware.live lists Lumax (www[.]elumax[.]com) in Germany as a claimed victim of Krybit, citing the group's leak-site post dated June 3, 2026. The claim is unconfirmed.
A ransomware.live monitoring record attributes a ransomware attack claim against Brazil’s Eat Salad to Qilin. The attackers reportedly claimed data disruption and made extortion demands; the post says the claims are unconfirmed.
A ransomware.live record says Qilin claimed MarketJoy as a victim, with the claim discovered and published on June 3, 2026. The post says the allegation is unconfirmed.
A ransomware.live monitoring post attributes to Qilin a claim targeting South Korean manufacturer JNP ENG. The post says encryption and ransom demands were involved but notes the claims are unconfirmed.
Shadowbyt3$ claims it stole and exfiltrated student and guardian records and proprietary academic materials linked to Lead Company and several schools. The claim is unconfirmed.
A ransomware.live monitoring record lists Ace Hospital (acehospital[.]in) in India as a victim claimed by KillSec. The claim is unconfirmed; no disclosures were reported and the ransom price is undisclosed.
A ransomware.live monitoring post says KillSec allegedly targeted csinsurance[.]mx in Mexico, encrypting files and demanding a ransom. The claim is unconfirmed, and no public disclosures are reported.
ransomware[.]live records an unverified ransomware claim against elections[.]mia[.]gov[.]am in Armenia, attributed to WOLVES OF TURAN/APT73. The article says the claim could not be independently confirmed.
Ransomware.live lists trrac[.]net as an Incransom victim, citing the group's leak-site claim of about 150GB of data involved. The post says the claim could not be independently verified.
Stormous claims it exfiltrated over 10 GB from katholiekamersfoort[.]nl, including donor and staff records, personal data, internal documents and system metadata. The claim is unconfirmed.
A ransomware.live monitoring post attributes an unconfirmed claim to Spacebears that it targeted Stellar Telecommunications SAS, citing the company’s database and production configuration. The post says the claim could not be confirmed.
Interlock claims it compromised Cold Front Distribution and alleges it obtained partner pricing and business documents, employee information, and financial data. The claims are unconfirmed.
Ransomware.live lists iql-nog[.]com in Spain as a SafePay claim, citing the group’s leak-site post. The target is linked to an oleochemicals producer; the claim is unconfirmed.
Krybit claims www[.]transbras[.]com[.]gt, a transportation and logistics victim in Guatemala, as a ransomware target. The claim is unconfirmed; the post cites the actor’s blog and ransomware.live monitoring.
Krybit reportedly claimed Activ’Interim 88 (activ88-interim[.]com) in Germany as a target. The claim was monitored by ransomware.live and is unconfirmed; the article says it cannot verify the group’s claims.
ransomware.live recorded a Qilin claim targeting Nova Medical Products in the US. The post cites Qilin’s leak-site source; the claim is unconfirmed.
Ransomware.live lists Elektroverband Bayern as a Black X victim, citing the group’s onion-site entry. The compromise claim is unconfirmed. The record’s discovery date (June 2, 2026) postdates its listed publication date (May 7, 2025).
