Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2826 articles
ShinyHunters claims it exfiltrated more than 700,000 BCD Travel Salesforce records and corporate SharePoint data, demanding contact by June 1, 2026, or threatening to leak the data. The claim is unconfirmed.
Ransomware.live reports that the Chaos group claims it stole Entrans International data and may publish it within 72 hours. The claim is unconfirmed; the listing says publication is pending.
Chaos claims it obtained internal data from PowerHouseNow and warns it may publish the data within 72 hours. The group says it tried to contact management; the claim is unconfirmed.
Ransomware.live lists Techmar as a target of thegentlemen, which reportedly claimed disruption to systems and data. The post says the claim is unconfirmed; it lists the victim's country as the UK but also says Techmar is headquartered in the Netherlands.
A ransomware claim attributed to thegentlemen names Mayelia Automotive. The post associates the alleged activity with disruptions to the company's services, but says the claim has not been confirmed.
A ransomware.live record attributes a claim against U.S. law firm Peña & Bromberg to Genesis. The post says the claim is based on the group’s public statements and has not been independently confirmed.
Ransomware.live reports an unverified Everest ransomware-group claim targeting German logistics company Spedition Kern, dated May 28, 2026. The post says it caused operational disruption; no company confirmation is provided.
ransomware[.]live attributes a claim targeting American Battery Factory to Worldleaks and reports alleged disruption to U.S. manufacturing operations. The post says the claim is unconfirmed.
A ransomware.live monitoring post attributes a ransomware claim against US manufacturer Carton Craft Supply to Qilin. Disruption and attempted encryption are reported as claims; the post says it cannot confirm their accuracy.
Qilin claims it encrypted files and disrupted operations at Mindpath College Health. The post attributes the claim to the group's leak-site listing and says it could not confirm the information.
Ransomware.live lists Sinomax USA as a Qilin ransomware claim dated May 28, 2026. The post says the information comes from the group’s public claims and has not been independently confirmed.
Ransomware.live reports that 0day Syndicate claimed DXON (dxon[.]com[.]br) as a victim on May 28, 2026, threatening operational disruption and data exfiltration; the claim is unconfirmed.
Ransomware.live lists GoKids as a claimed victim of 0day Syndicate, citing a group source. The alleged ransomware incident and reported impact on its educational platforms are unconfirmed.
Ransomware.live reports that 0day Syndicate claimed an attack on XGenize, alleging data and service disruption. The article says the claim is unconfirmed.
Ransomware.live records an unconfirmed DragonForce claim naming K. Smart Associates Limited, published May 27, 2026. The post attributes the claim to the group but provides no independent confirmation.
Incransom claims it stole about 100 GB of data from Spanish firm Lawants, including client, financial and corporate information. The monitoring post says the claim is unconfirmed.
A ransomware.live record says ShinyHunters threatened to leak allegedly compromised DentaQuest data unless the company responded by May 29, 2026. The claim is unconfirmed.
Qilin allegedly claimed an attack on UK construction company William Davis Homes. The monitoring post says the claim is based on the group's public statements and has not been independently confirmed.
A ransomware claim attributed to DragonForce lists President Container Group in Singapore as impacted. The monitoring post cites a leak-site source and says the claim could not be independently confirmed.
Nova claims it intruded on My English House academy in Spain and provided proof and stolen-data samples; it offered more samples to the school through its support department. The claims are unconfirmed.
Ransomware[.]live records a Qilin claim targeting Hungary’s Otthon Centrum. The post alleges compromise, encryption and service disruption, but says the claims are unconfirmed.
Nova claims it can decrypt two files from CasaSafer as proof and threatens to withhold a full decryptor after 10 days without contact. The group says the website is down; the claims are unconfirmed.
Ransomware.live reports that Chaos threatened to release about 503 GB of data allegedly associated with Sterling Industries (sterlingindustries[.]com). The claim is unverified.
Ransomware.live lists Thailand-based Smile Siam Printing Service as a victim claimed by krybit. The post attributes the allegation to the group and says it cannot confirm its accuracy.
