Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2769 articles
TheGentlemen claimed a ransomware attack on South African retailer Edcon, listing edcon.co.za. The claim is unverified; the post provides no confirmed details about access, data theft, encryption, or operational impact.
A ransomware claim by thegentlemen names South African healthcare scheme Samwumed. The post gives no verified details about impact or data, and says the claim could not be confirmed.
A ransomware claim naming South African legal-expenses provider LegalWise (legalwise[.]co[.]za) was attributed to thegentlemen. The source says it cannot verify the group’s claims.
A ransomware.live monitoring post reports that Gammax named U.S. manufacturer Crowder Industries, Inc. The post says the claim may involve operational and data-availability impacts but states it could not verify the information.
Ransomware.live reports that Gammax allegedly targeted Christchurch tutoring company AHeadStart Tutoring. The group’s claim has not been independently confirmed.
ShinyHunters claims its operations remain intact and says data held from organizations negotiating with the group may be published. The monitoring record notes that the claims are unverified.
Ransomware group emperador claims it attacked Colombian manufacturer Polikem and exposed financial, inventory, and other internal data. The monitoring post says the claims have not been independently confirmed.
A ransomware claim attributed to kairos names US appliance repair company Unique Repair Services. The post says the claim’s accuracy could not be confirmed.
Ransomware group m3rx claims an incident involving Polish IT company intense[.]pl, listed by ransomware.live on Sept. 29, 2026. The publisher says it cannot verify the claim; no impact details are provided.
A ransomware.live monitoring post lists Gibson Area Hospital & Health Services as a Wallstreet ransomware claim, published September 29, 2026. The post says it cannot confirm the claim’s accuracy.
Chaos claims it compromised advantech[.]com and published 5% of the data, threatening to release the rest in 48 hours. The report says the claim could not be independently confirmed.
A ransomware group allegedly targeted Groupe Proxitel, disrupting its connectivity, telephony, cybersecurity, and backup services in Turkey. The claim has not been confirmed.
The ransomware group incransom claims it leaked 500 GB of data from BCX, including source code and business applications. The monitoring post says the claims are unverified.
Ransomware.live lists somasolucoes.com in Brazil as a target claimed by m3rx, with claim and discovery timestamps of September 29, 2026. The post says the claim is unverified.
A ransomware.live record says the group m3rx claims to have exfiltrated 82.5 GB across 106,460 files from Otero Geeza Law, associated with oterolaw[.]com. The publisher says it cannot confirm the claim.
The ransomware group Chaos claims it will disclose 290 GB of data from Carolina Asthma unless management reaches an agreement within 24 hours. The report says the data may include sensitive patient and business records; the claim is unverified.
Ransomware.live reports that the group threeam claimed an attack on Argentine manufacturer pistonespersan[.]com[.]ar. The post says the claim could not be independently confirmed.
Ransomware group N0n claims it accessed Precision Facades Ltd’s complete file server, including financial, project and confidential commercial records. The claim is unconfirmed; a deadline is listed for October 2, 2026.
A ransomware.live record says LockBit5 claimed Camorim Serviços Marítimos (camorim[.]com[.]br) as a target. The post attributes the claim to the group and says it could not confirm the information.
Ransomware.live records a ThreeAM ransomware claim involving Colombia’s Coosalud health entity and says the attack disrupted healthcare operations. The post says the claim is unconfirmed.
A ransomware.live post lists MinMor Industries as targeted by the ransomware actor cry0, with a discovery date of September 28, 2026. The post says the claim is unconfirmed; further details are pending.
A ransomware.live monitoring post reports that the netrunner group claimed an attack on M*** P**** M*** in Malaysia. The post says the claim could not be confirmed.
Threeam claims a ransomware attack on UK scaffolding contractor safescaffolding[.]net. The claim was listed on September 28, 2026; its accuracy is unconfirmed.
A ransomware group called incransom claims Bakemyday.se, a Swedish bakery business, is a victim. The monitoring post says the claim was discovered September 28, 2026, and notes it could not be independently confirmed.
