AiLock Claims Attack on Artso International, Inc.
AiLock reportedly claimed an attack on Artso International, Inc., alleging encryption to pressure the US-based furniture company and disrupt operations. The claim is unconfirmed.
Ransom Monitor
Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2828 articles
DragonForce Claims Ransomware Attack on Prologic Construction
A ransomware.live monitoring record attributes a ransomware claim involving Alberta contractor Prologic Construction to DragonForce. The post says the claim is unconfirmed.
DragonForce Claims Ransomware Incident Involving HELIX INTERNATIONAL
Ransomware.live reports that DragonForce claimed an incident involving UK-based HELIX INTERNATIONAL. The record lists the claim as published May 24, 2026, and says its accuracy cannot be confirmed.
DragonForce Claims Heartland Growers as a Ransomware Victim
A ransomware.live post attributes a ransomware claim against Indiana-based Heartland Growers to DragonForce. The article says operations were disrupted but notes the information is based on the group’s public claims and is unconfirmed.
Bravox Claims Emek Elektrik as a Victim in Turkey
A monitoring post lists Turkish energy-sector equipment manufacturer Emek Elektrik as a Bravox victim. It says the claim involved disruption, but provides no independent confirmation.
Bravox Claims Ransomware Attack on Salvation Army in Canada
Ransomware[.]live lists the Salvation Army in Canada as a Bravox victim and reports claimed disruption to its services. The article says the information comes from public group claims and is unconfirmed.
Stormous Claims 40GB Data Dump From vspsolutions.com.au
Stormous claims a data dump from vspsolutions.com.au containing 40+ GB of financial backups and other records. The monitoring post says the group’s claims are unconfirmed.
Incransom Claims It Stole 100GB of Data From Spanish Aerospace Manufacturer
Incransom claims it stole about 100GB of confidential and business data from Spanish aerospace manufacturer Mecanizados y Montajes Aeronáuticos. The monitoring post says the claim is unconfirmed.
Krybit Claims Bangkok Metropolitan Administration as a Ransomware Victim
Ransomware.live recorded a Krybit claim naming the Bangkok Metropolitan Administration (BMA) and bangkok[.]go[.]th. The post says services were disrupted, but the information is based on the group’s claim and is unconfirmed.
AuditTeam Claims Ransomware Attack on Mopas Online Supermarket in Turkey
A ransomware.live post attributes to AuditTeam a ransomware attack on Turkish retailer Mopas Online Supermarket, claiming its online shopping and delivery services were disrupted. The claim is unconfirmed.
Nova Claims It Stole Personal Data from the University of Valencia
The ransomware actor nova claims to have stolen personal data from the University of Valencia, including student records, staff files and children’s photos. The claim is unconfirmed; the actor reportedly offered to negotiate.
APT73 Claims Targeting of Turkey’s TKGM
A claim attributed to apt73 says Turkey’s TKGM was targeted by ransomware. The monitoring post cites the actor’s leak site and says the claim is unconfirmed.
ShinyHunters Claims Ransomware Attack on DentaQuest, Threatens Data Leak
ShinyHunters claims it ransomware-attacked DentaQuest[.]com and threatens to leak allegedly compromised information unless the victim responds by May 27, 2026. The claim is unconfirmed and attributed to ransomware.live monitoring.
ShinyHunters Claims 42 Million Charter Communications Records Compromised
ShinyHunters reportedly claimed it compromised over 42 million Charter Communications records containing PII and issued a final warning on May 23, 2026, demanding contact by May 27. The claim is unconfirmed.
ShinyHunters Claims Baker Distributing Data and Sets May 27 Leak Deadline
A ransomware.live monitoring record attributes to ShinyHunters a claim that Baker Distributing Company’s Salesforce data was compromised, with a May 27, 2026 leak deadline. The claim is unconfirmed.
Akira claims ransomware attack on Karlin Foods and threatens data publication
Akira claims it hit Karlin Foods with ransomware and says it plans to publish company data, including employee and client information, contracts, financials, and project materials. The claim is unconfirmed.
Krybit Claims lasevillanita.com in Ransomware Listing
Ransomware.live lists lasevillanita.com as a victim claimed by Krybit, citing the group’s blog. The post says the claim is unconfirmed.
Gunra Claim Names Cablematic Dos Mil SLU in Ransomware Listing
A monitoring record lists Cablematic Dos Mil SLU as the subject of a ransomware claim attributed to gunra. The post says the claim is based on the group's public assertions and that it cannot confirm their accuracy.
Nova Claims Hoy Construction as a Ransomware Victim
Ransomware.live reported an unconfirmed nova claim naming Virginia-based Hoy Construction. The actor allegedly offered a “tree” and samples from purported stolen data if the company contacted its support department.
Nova Claims Data Theft From Vietnam-Based AMACCAO
Ransomware group nova claims it targeted Vietnam-based AMACCAO and says it will provide a data tree and stolen-data samples through the company's support department. The claim is unconfirmed.
Qilin Claims Ransomware Incident at Semgrep
Ransomware.live lists Semgrep as a Qilin ransomware victim, citing a group leak-site post dated May 22, 2026. The report is based on the group's public claim, which the author says is unconfirmed.
Worldleaks Claims Ransomware Attack on BMJ Paperpack in Indonesia
A monitoring post lists BMJ Paperpack in Indonesia as a worldleaks ransomware victim and reports disruption to systems and data access. The post says the group's claims are unconfirmed.
Akira Claims It Will Publish 30GB of Data From GITIS S.r.l.
Akira allegedly threatened to publish about 30GB of data from Russian manufacturer GITIS S.r.l., including employee information, contracts, financial records, client data, project files, and NDAs. The claim is unconfirmed.
Incransom Claims Access to Thread Innovations Files
The incransom group claims it accessed Thread Innovations’ confidential files, including client data, proprietary R&D and financial documentation. The claim was listed by ransomware.live and is unconfirmed.