Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2830 articles
ransomware[.]live attributes a claim to Akira alleging that Function Enterprises’ corporate data was encrypted and exfiltrated, including employee IDs, client, financial and project records. The post says upload was threatened; accuracy is unconfirmed.
Akira claims it targeted Buffalo Niagara Convention Center and threatens to expose data, including employee information and records concerning 180,000 people. The monitoring post says the claims are unconfirmed.
Ransomware[.]live reports that APT73 claims TVN Media (tvnmedia[.]com), listed in Poland, as a victim and alleges encryption or disruption to extort it. The claim is unverified; no independent confirmation is provided.
A ransomware.live monitoring record attributes a ransomware claim involving Le Pain Quotidien US to DragonForce. The post says the group made the claim, but its accuracy is unconfirmed.
Ransomware.live lists MBM Corp as targeted by thegentlemen, who allegedly deployed ransomware via the victim’s infrastructure. The claim was published May 21, 2026, and is unconfirmed.
Ransomware.live reports that thegentlemen claimed Grupo Pasquel, an Ecuadorian enterprise, as a victim on May 21, 2026. The post alleges operational impact, but the claim is unconfirmed.
Ransomware.live lists Austrian construction company ROTO Immobilien as a Qilin ransomware claim dated May 21, 2026. The post alleges systems were compromised and ransom demanded, but says the claims are unconfirmed.
apt73 allegedly claimed Alkaloid, a pharmaceutical company in North Macedonia, as a victim. ransomware[.]live recorded the claim on May 21, 2026, and says it cannot confirm its accuracy.
Ransomware.live lists Snyder Packaging as a Qilin ransomware claim, alleging operational disruption in the United States. The post says the group’s claims are unconfirmed.
A ransomware.live record dated May 21, 2026, attributes a ransomware claim against US firm Vernon & Ginsburg to Qilin. The post says the claim is unconfirmed.
Ransomware.live lists sheppadviser[.]com[.]au as a BrainCipher victim, citing a group claim published May 21, 2026. The post says the claim is unconfirmed; no victim statement or independent evidence is provided.
Ransomware.live reports that APT73 claimed activity against Thailand’s National Astronomical Research Institute (narit[.]or[.]th), including alleged service disruption and data encryption. The claim is unconfirmed.
ransomware.live reports an unverified apt73 claim against Argentina’s Grupo Petersen, alleging disruption to business systems and data availability. The post says the claim is based on the group’s public statements.
Ransomware.live reports that the Payload group claimed Robinsons in Singapore was targeted, with alleged encryption, operational disruption and a ransom demand. The post says the claims are unconfirmed.
The nova ransomware group claims it took down multiple Neubox websites and threatens to leak source code, documents, databases, and phpMyAdmin-related information. The post says the claims are unconfirmed.
Ransomware.live lists Softseba as a victim claimed by the nova ransomware group, which reportedly encrypted or disrupted data and demanded a ransom. The article says the claim is unconfirmed.
Ransomware.live records an unconfirmed Payload claim targeting Internal Medicine and Pediatrics of Cullman, a US healthcare practice. The listing was published and discovered on May 21, 2026; no independent confirmation is provided.
A ransomware.live monitoring record attributes a claim involving Singapore-based A-Sonic Logistic Solutions to the Payload ransomware group. The claim is unconfirmed.
Ransomware.live lists German manufacturer G Theodor Freese as a target of a Payload ransomware claim. The article attributes the claim to the group's post but says it cannot confirm the information.
Ransomware.live reports that shadowbyt3$ claims Starbucks was breached after closing the starbucks-prod S3 bucket. The actor alleges a $500,000 demand went unanswered; the claims are unverified.
Ransomware[.]live reports that shadowbyt3$ claims Hotelogix Company in India ignored repeated payment warnings. The group urged other organizations to verify alleged leaked evidence. The claim is unconfirmed.
The pear ransomware group claims it attacked Exchange Group, a Manitoba accounting and consulting firm, and says data was encrypted. The claim is unverified; the post cites the group's leak site and ransomware.live monitoring.
A ransomware[.]live monitoring post attributes an unconfirmed ransomware-victim claim for Indian Creek Valley Water Authority in the US to the “pear” group, citing its leak-site listing.
Ransomware[.]live lists Fana Jewelry Inc. as a victim of a claim by the “pear” ransomware group. The post cites the group’s leak-site page and says the claim is unconfirmed; it provides no incident details.
