Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2822 articles
A ransomware claim attributed to cmdorganization names Lake Washington School District as the victim and alleges disruption to school and administrative operations. The post says the claim is unconfirmed and is monitored by ransomware.live.
A ransomware.live monitoring post attributes a claim about STAREMPIRE in Vietnam to Gunra. The post alleges compromise, file encryption and service disruption, but says the claims are unconfirmed.
A post attributed to the termite ransomware group names UEI College as a victim and claims disruption across multiple locations. The monitoring article says the claim has not been independently confirmed.
A ransomware.live monitoring post attributes a ransomware claim against Indiana Mills and Manufacturing to the Termite group, which reportedly demanded contact within 24 hours. The claim is unconfirmed.
A ransomware.live post lists Cedar Street Capital, part of a Cynvestors Limited Partnership, as a Genesis ransomware victim. The post was published May 30, 2026; the claim is unconfirmed.
Ransomware.live reports that the genesis group listed U.S. fertilizer distributor Green Resource, claiming a ransomware attack; the post says operations were disrupted, but notes the claim is unconfirmed.
Ransomware[.]live lists Wentworth, a US design-build firm, as a victim claimed by Genesis. The post alleges operational and systems disruption but says the claim has not been independently confirmed.
A ransomware.live monitoring record attributes a claim involving U.S. contractor Cavalier Flooring Systems Inc. to the Genesis ransomware group. The post says the claim is unconfirmed.
Ransomware[.]live lists an unconfirmed krybit claim of a complete data breach at Tulip Mediworld Hospital in Guwahati, India. The post says it cannot verify the claim.
Ransomware.live lists Pragmatic Solutions as a CoinbaseCartel claim dated May 30, 2026. The post alleges encryption and operational disruption but says the claims are unconfirmed.
A ransomware claim attributed to coinbasecartel lists Openmind Networks as a victim. The claim was recorded by ransomware.live on May 30, 2026; the article says it cannot confirm the claim.
Ransomware[.]live lists French CMMS/EAM provider Siveco in a coinbasecartel ransomware claim. The supplied post says the claim is unconfirmed.
A ransomware.live monitoring record attributes a ransomware claim against Plexsupply Inc to pear. The article says the claim is based on the group’s public claims and has not been confirmed.
Ransomware.live records a claim by actor krybit targeting ecci-srl[.]com in Italy, published May 30, 2026. The post describes the organization as a real-estate development company; the claim is unconfirmed.
A ransomware.live monitoring record attributes a ransomware claim against Apex Maritime Co., Inc. to titan. The post alleges disruption to the company's logistics operations, but the information is unconfirmed.
The titan ransomware group claimed an incident involving SIRILAK SEAFOOD (PW) LTD. in Sri Lanka. The monitoring post cites the group's source but says the claim could not be confirmed.
A ransomware.live monitoring post attributes an unconfirmed claim to Lapsus$ alleging compromise of Vodafone Germany’s infrastructure, including access to source code, GitHub tree data, and internal network maps.
Ransomware.live reports that nova claimed to have stolen data from Daegu University AI Department and offered a tree and samples as proof. The claim and reported impact are unconfirmed.
Ransomware.live reports that Akira claims to have targeted Schacht Law Office and threatens to upload 20 GB of corporate data, including client records and legal documents. The claim is unconfirmed.
Ransomware.live says the Kairos group publicly claimed targeting Commune De Camiers, a French public-sector organization. The post's author says the claim is unconfirmed.
Ransomware[.]live lists AcademyHealth as a bravox ransomware claim dated May 29, 2026. The post alleges operational disruption, but the article says the claim is unconfirmed.
A ransomware.live record attributes a ransomware claim involving Capital Family Physicians to cmdorganization. The post alleges disruption to patient care and records, but says the group’s claims are unconfirmed.
A ransomware.live monitoring record attributes to Gunra a claim that it attacked France-based SOMAFIX, encrypted files and disrupted operations. The claims are unconfirmed.
A ransomware.live monitoring record attributes to Akira a claim that it accessed and encrypted Interstate Roofing data and exfiltrated 16 GB, including employee documents, contracts, and client information. The claims are unconfirmed.
