m3rx Claims 50 GB Data Theft from Spanish Retailer dosocho.es
Ransomware group m3rx claims it stole 50 GB across 28,000 files from Spanish automotive-parts retailer dosocho[.]es. The monitoring post says the claim is unconfirmed.
Ransom Monitor
Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2830 articles
Nova ransomware claims Don Bosco Technical Institute of Makati
Ransomware.live reports Nova’s claim targeting Don Bosco Technical Institute of Makati in the Philippines. The post says the claim is unconfirmed; the school has not provided a statement in the supplied content.
Nova Claims Ransomware Incident at BAUM Games
Ransomware.live reports a ransomware claim by nova against Germany-based BAUM Games. The post says the claim is unconfirmed and links to the actor’s onion page.
Incransom Claims Targeting Metaval Consolidated
Incransom claimed to target Metaval Consolidated (metaval[.]com[.]au). ransomware.live recorded the claim on May 17, 2026; the post says it is unverified.
Nova Claims Ransomware Attack on URG OEM
Ransomware.live lists URG OEM as a victim in a claim attributed to nova, published May 17, 2026. The post alleges disruption to systems and data access; the claim is unconfirmed.
Qilin Claims Ransomware Attack on Chilean Company Comercial Echave Turri Limitada
A ransomware.live monitoring post attributes a claim against Chilean company Comercial Echave Turri Limitada to Qilin. The post says the claim appeared on the group’s leak site; the incident details are unconfirmed.
Qilin Claims PNSB Insurance Brokers Sdn Bhd as a Victim
A ransomware.live monitoring post attributes a claim against Malaysia’s PNSB Insurance Brokers Sdn Bhd to Qilin, alleging file encryption and business disruption. The post says the claims are unconfirmed.
PrinzEugen Claims Encryption and Data Theft at Transitions Pro Centre Val de Loire
PrinzEugen claims it exfiltrated and encrypted hundreds of gigabytes from French organization Transitions Pro Centre Val de Loire and threatens public release; the monitoring post says the claims are unconfirmed.
Qilin Claims Attack on Clinica Avellaneda Medical Center in Argentina
ransomware.live records Qilin’s claim targeting Clinica Avellaneda Medical Center in Argentina. The post alleges disruption to healthcare operations but says the claim could not be confirmed.
Beast Claims Trivantage Ransomware Incident
Ransomware[.]live lists Trivantage, a U.S. fabric supplier, in a Beast ransomware claim. The post says the claim is unconfirmed and provides no independent evidence of compromise or disruption.
Ross Yerger Insurance Named in TheGentlemen Ransomware Claim
A ransomware monitoring record says thegentlemen made a public claim involving Ross Yerger Insurance. The claim is unconfirmed, and the article provides no details about affected systems or data.
Termite Claims RAMAR FOODS INTERNATIONAL as a Ransomware Victim
A ransomware claim attributed to termite names RAMAR FOODS INTERNATIONAL as a victim. The claim is unconfirmed; the record says it is monitored by ransomware[.]live.
Lamashtu Claims Ransomware Attack on Parle Agro
A ransomware.live-monitored record attributes an unverified ransomware claim against Indian food and beverage maker Parle Agro to lamashtu. The post alleges operational disruption, but the author says the claim is unconfirmed.
DragonForce Claims AdvancedHEALTH Data Leak, Threatens Daily Releases
A ransomware.live monitoring post attributes to DragonForce an unverified claim that AdvancedHEALTH data was leaked and threatens daily releases of more patient data unless payment is made.
Akira Claims Fox Valley Tax Solutions Data Theft
A ransomware.live monitoring post attributes an unconfirmed claim to Akira targeting Fox Valley Tax Solutions. The group reportedly claims 95 GB of corporate data, including client identifiers and financial information, will be uploaded.
DragonForce Claims Advanced Medical Consultants Data Leak
DragonForce reportedly claims Advanced Medical Consultants' leak includes 2.3 million lines of patient data and partner, management, payroll, and HR files, threatening daily releases until payment or timer expiry. The claim is unconfirmed.
Qilin Claims Foot Solutions Ransomware Incident
Ransomware[.]live reports a Qilin claim targeting US-based Foot Solutions, alleging system disruption and data encryption. The post says the claim is unconfirmed.
Qilin Claims Attack on Common Part Groupings; Claim Unconfirmed
Ransomware.live records an unconfirmed Qilin claim targeting Common Part Groupings in the US, alleging encryption and disruption. The post says it could not verify the claim.
Rhysida Claim Involves Tower View Primary School
A ransomware.live-monitored post attributes an unconfirmed ransomware claim involving Tower View Primary School to Rhysida. It alleges operational disruption but says the group’s claims could not be verified.
Qilin Claims Menzies Group as Ransomware Victim
A ransomware.live post attributes a ransomware claim against Australia’s Menzies Group to Qilin. The post says systems were affected and operations disrupted, but the claim and those details remain unconfirmed.
Qilin Claims Ransomware Attack on Australia's Generation Life
A ransomware.live monitoring record attributes a ransomware claim against Australia's Generation Life to Qilin. The post says encryption and operational disruption were reported but notes the group's claims are unconfirmed.
Qilin Claims Australian College of Business Intelligence in Ransomware Listing
A ransomware.live record attributes a Qilin claim against Australian College of Business Intelligence to a leak-site post. The reported unauthorized access, encryption, disruption and potential data compromise remain unconfirmed.
Qilin Claims Ransomware Attack on Turner Supply
A monitoring post attributes a ransomware claim against Turner Supply to Qilin, alleging operational disruption and encrypted data. The post says the claim is unconfirmed.
Qilin Claims NR Engineering Co., Ltd. in Thailand Was Targeted
Qilin reportedly claimed NR Engineering Co., Ltd. in Thailand was targeted and that its data and systems were encrypted for extortion. The claim is unverified and attributed to a leak-site listing monitored by ransomware[.]live.