CoinbaseCartel Claims It Targeted Grafana in Ransomware Post
ransomware[.]live reports that CoinbaseCartel claimed to have targeted Grafana and threatened further damage. The post says the claim is unconfirmed.
Ransom Monitor
Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2831 articles
CoinbaseCartel Claims Targeting Zywave; Service Disruption Unconfirmed
A ransomware.live post attributes to coinbasecartel a claim that it targeted Zywave and disrupted the company's cloud services. The post says the information is unconfirmed.
Qilin Claims B.Care Medical Center Compromise in the Philippines
Qilin claimed it compromised B.Care Medical Center in the Philippines and encrypted or stole data. The monitoring post says the claim is unconfirmed.
Raise the Bottom Named in Unverified cmdorganization Ransomware Claim
Ransomware.live lists Raise the Bottom, an Idaho opioid treatment center, in an unverified ransomware claim attributed to cmdorganization. The article says the claim’s accuracy has not been confirmed.
DragonForce Claims LeRoy Surveyors & Engineers as a Ransomware Victim
A monitored record attributes a claim involving LeRoy Surveyors & Engineers to DragonForce on May 15, 2026. The article says it cannot confirm the accuracy of the claim.
incransom Claims defenseisready.com as Ransomware Victim
A ransomware.live post lists defenseisready.com as a claimed victim of incransom, citing the actor’s disclosure page. The claim, including reported disruption, is unverified and not independently confirmed.
Kairos Claims Ransomware Incident at McCarthy Inc.
A ransomware.live-monitored post attributes a ransomware claim against McCarthy Inc. to the Kairos group. The post says operations and services were affected, but notes the claim is unconfirmed.
Krybit Claims Ransomware Attack on Wa Wai Assembly of God Church
Krybit’s leak site claims the group targeted Wa Wai Assembly of God Church (wwag[.]org). The monitoring post says the claim is unconfirmed.
Thegentlemen Claims Ponisch Abogados in Mexico as a Ransomware Victim
Ransomware.live lists Ponisch Abogados in Mexico in a claim attributed to thegentlemen. The post says the claim is unverified and provides no independent confirmation.
Thegentlemen Claims Ransomware Attack on Brazil’s Grupo Alvorada
Ransomware.live reports that thegentlemen claimed an attack on Brazil’s Grupo Alvorada, allegedly affecting galvorada[.]com. The post says the claim is unconfirmed.
TheGentlemen Claims Instituut voor de Nederlandse as a Ransomware Victim
A ransomware.live monitoring post attributes an unconfirmed ransomware claim involving Dutch language institute Instituut voor de Nederlandse to thegentlemen.
Qilin Claims Schulte-Lindhorst GmbH & Co. in Ransomware Listing
A ransomware.live-monitored record attributes a ransomware claim against German manufacturer Schulte-Lindhorst GmbH & Co. to Qilin; the publisher says the group's claim is unconfirmed.
ShadowByt3$ Claims Breach of Hotelogix and Demands $500,000
ShadowByt3$ claims it breached Hotelogix through misconfigured Amazon S3 buckets and Azure blobs, scraping data and demanding $500,000 in BTC or Monero to prevent a leak. The claims are unconfirmed.
Incransom Claims It Stole Data From United Quality Cooperative
Incransom claims it stole internal correspondence, financial documents and employee personal data from United Quality Cooperative, threatening public release within a week if demands are not met. The claim is unconfirmed.
University of Georgia Named in ShadowByt3$ Data-Theft Claim
ShadowByt3$ claims it breached the University of Georgia and posted about 3.2 MB of employee and institutional data. The claim is monitored by ransomware[.]live and is unconfirmed.
Shadowbyt3$ Claims Attack on India's PowerCampus Platform
A ransomware.live monitoring post attributes an unverified attack claim against India's PowerCampus to shadowbyt3$. The group reportedly claimed impacts to the platform's education services; the post says the claim is unconfirmed.
cmdorganization Claims Ransomware Attack on Houston Eye Associates
A ransomware claim attributed to cmdorganization names Houston Eye Associates, a healthcare provider with 20 Greater Houston locations. The claim was published May 14, 2026, and the article says it could not be independently confirmed.
Shadowbyt3$ Claims Theft of 1.69 GB From Amplify Technology
Ransomware[.]live lists Amplify Technology Limited as a shadowbyt3$ victim, alleging theft of about 1.69 GB of project materials, financial records and personal information; the claim is unconfirmed.
Shadowbyt3$ Claims $500,000 Ransom Demand Against Stride Learning
A post attributed to shadowbyt3$ claims the group demanded $500,000 in Bitcoin or Monero from Stride Learning and threatened to leak data if unpaid. The claim is unconfirmed.
Morpheus Claims Ransomware Attack on BAYTECH A/S
Ransomware.live lists BAYTECH A/S in Denmark as a Morpheus ransomware claim dated May 14, 2026. The post says the claim is unconfirmed and attributes an operational disruption allegation to the group.
Akira Claims Access to 55 GB of Institute of PrivateEnterprise Development Data
Akira allegedly claimed access to 55 GB of the Institute of PrivateEnterprise Development’s data, including personal and financial information. The claim is unconfirmed; ransomware.live says it monitors the record.
cmdorganization Claims Goodstone Group as a Ransomware Victim
A ransomware.live monitoring post attributes an unverified ransomware claim naming Goodstone Group to cmdorganization. The post says it cannot confirm the claim.
Abyss Claims Technic Inc. in Ransomware Post
A post monitored by ransomware[.]live attributes a ransomware claim against Technic Inc. to abyss, dated May 14, 2026. The publisher says it cannot confirm the information.
Qilin Claims Fab-Masters Ransomware Incident in the US
A ransomware.live monitoring post attributes a ransomware claim against U.S. manufacturer Fab-Masters to Qilin. The post says the claim alleges disruption to systems and data, but notes it could not confirm the information.