Krybit Claims Ransomware Attack on MotoFrenos
Ransomware.live lists MotoFrenos (motofrenos[.]com) as a Krybit victim, claiming file encryption and operational disruption; the post says the claims are unconfirmed.
Ransom Monitor
Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2828 articles
Qilin Claims Ransomware Attack on Roofing Solutions
Ransomware.live lists US construction company Roofing Solutions as a Qilin victim. The post attributes the claim to the group’s leak site and says it cannot verify the incident.
Qilin Claims Shocco Springs as Ransomware Target; Claim Unverified
ransomware.live monitored a Qilin claim naming Shocco Springs in the US as a ransomware target. The post says system access was disrupted and data may have been encrypted, but the claims are unconfirmed.
Qilin claims ransomware attack on Mainstreet Organization of REALTORS
Ransomware[.]live lists Mainstreet Organization of REALTORS as a Qilin ransomware victim, citing the group’s leak-site post. The entry alleges file encryption and disruption, but the article says the claims are unconfirmed.
DragonForce Claims Ransomware Attack on Waypoint Business Solutions
ransomware.live lists a DragonForce claim targeting WaypointSolutions[.]com and alleging disruption to customer IT services through Dell partnerships. The post says the claim is unconfirmed.
DragonForce Claims ERH as a Ransomware Victim
Ransomware.live attributes a claim concerning ERH’s UK traffic management operations to DragonForce. The group allegedly caused service disruption and compromised data; the article says these claims are unconfirmed.
DragonForce Claims Fabbrica LLC in Ransomware Listing
Ransomware.live lists a DragonForce claim targeting fabbricausa[.]com, identified as Fabbrica LLC. The post cites the group's leak site and says the claim's accuracy is unconfirmed.
DragonForce Claims Ransomware Incident at Berlin Housing Cooperative WG Neukölln
A ransomware claim-monitoring post attributes a claimed incident affecting Berlin housing cooperative WG Neukölln eG to DragonForce. The post says the claim is unconfirmed.
DragonForce Claims Delbrook Capital Advisors as Ransomware Victim
Ransomware.live reports that DragonForce claimed Delbrook Capital Advisors as a victim. The post alleges operational disruption, but says the claim is unconfirmed.
DragonForce Claims Greenway Technologies in Germany Was Affected by Ransomware
DragonForce allegedly claimed ransomware activity involving Greenway Technologies in Germany. The claim was recorded by ransomware.live, which says it could not confirm the information.
SpaceBears Claims 1.6 TB of Ridge Law Firm Data
Ransomware group spacebears claims it compromised more than 1.6 TB of Ridge Law Firm data, including medical and financial records. The claim is unconfirmed.
Spacebears Claims Ransomware Attack on Gestordes
Ransomware.live reports that spacebears claims to have attacked Gestordes in Spain, exposing passports, IDs, financial documents and more than 200,000 files. The claim is unconfirmed.
Nova Claims It Targeted Textile Testing Services of America
Nova claims it targeted Textile Testing Services of America, identifying sandox[.]info as an initial access point and linking data to ttsamexico[.]com. The group says it provided data samples to the company; the claims are unverified.
Nova Claims to Have Stolen Data from Eriell
A ransomware.live record attributes a data-theft and extortion claim against Eriell to Nova. The claim appears on Nova’s leak site; the post says it has not been independently confirmed.
Krybit Claims Ransomware Incident Involving Taiwanese School Website
Ransomware.live reports that krybit claimed a ransomware incident involving ctps[.]tp[.]edu[.]tw, the official website of a Taiwanese public elementary school. The claim is unconfirmed.
Nova Claims Sandox.info as Ransomware Target
ransomware.live reports an unverified Nova ransomware claim targeting Sandox[.]info. The post says the site went down afterward and that Nova offered stolen-data samples and a directory tree; available OSINT is limited.
Akira Claims 13GB Data Theft Involving Sunrise and Two Country Clubs
Akira claims to have obtained 13GB of data from Sunrise, Toscana Country Club and Andalusia Country Club. The alleged material includes personal, financial and client information; the claims are unconfirmed.
Qilin Claims Hamister Group as a Ransomware Victim
ransomware.live reports that Qilin listed Hamister Group as a victim. The group allegedly encrypted data and disrupted systems; the claims are unconfirmed.
Lamashtu Claims H-W-G and Acros Sport in Ransomware Listing
Ransomware.live records an unverified lamashtu claim naming H-W-G & Acros Sport, published May 26, 2026. The post attributes the information to the group’s public claim; the publisher says it cannot confirm its accuracy.
Spacebears Claims Data Theft and Encryption at BASE S.p.A.
The spacebears ransomware group claims it stole and encrypted confidential and personal employee and client information, financial documents, and other files from Italy-based BASE S.p.A. The claim is unconfirmed.
SpaceBears Claims Hunter Exposed Employee and Client Data
SpaceBears claims Hunter exposed employee and client information, databases, financial documents, and other files. The post attributes the claim to the group's leak site and says it could not confirm its accuracy.
Spacebears Claims Filabé as a Ransomware Victim
The Spacebears ransomware group reportedly claims Filabé, a Switzerland-based skincare company, had employee and client information, financial documents and other files encrypted or exfiltrated. The claim is unconfirmed.
Play ransomware group claims attack on De Waard Transport
ransomware.live reports that the Play ransomware group claimed to target De Waard Transport in the Netherlands. The post says access to systems and data was disrupted, but the claim is unconfirmed.
Incransom Claims Open Door Health Center as a Victim
Ransomware.live lists Open Door Health Center, an Illinois healthcare provider, as targeted by Incransom. The post attributes the claim to the group's disclosure page but says it cannot confirm the information.