Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2834 articles
The Lynx ransomware group claims Jackson County Visitor Center / jacksoncountyin.com as a victim. The claim is attributed to the group’s leak site and monitored by ransomware[.]live; the article says it is unconfirmed.
Ransomware.live lists Bay Area Herbs (bayareaherbs[.]com) as a Lynx ransomware claim, citing the group’s leak site. The report says the claim is unconfirmed.
A ransomware.live monitoring record names AXCERA TRADING and attributes public claims to Lapsus$. The record lists trading algorithms, client portfolios, KYC data and financial logs; the claims are unconfirmed.
Ransomware.live records a Lynx leak-site claim naming St Anne’s Catholic School & Sixth Form College (st-annes[.]uk[.]com), discovered May 10, 2026. The claim is unconfirmed.
Ransomware.live lists Lifelong Access as a Lynx ransomware claim, alleging impact to its disability support services. The organization’s involvement is unconfirmed, and the article provides no official response.
The post says the Lynx group listed Taiwan-based CSB Energy Technology (csb-battery[.]com) on its leak site; the claim is unverified, with no independent evidence of operational impact or data theft provided.
Lynx reportedly listed Spain-based OS Sistemes as a ransomware victim. The post links to a leak-site claim and says the information is unconfirmed.
Ransomware.live lists lopezlawfl[.]com as a claimed Incransom victim, alleging full data encryption and extortion. The post says the group’s claims are unconfirmed.
Ransomware.live lists sibillacapital.com as a U.S. financial-services victim of an Incransom ransomware claim. The post alleges operational disruption and compromised data, but says the claims cannot be confirmed.
A ransomware.live-monitored post attributes to Stormous a claim of a 33GB data dump from ams-group.co.uk. The post lists purportedly exposed business, employee, engineering, financial and legal records; the claim is unconfirmed.
Arizona Professional Painting is listed in a ransomware claim attributed to thegentlemen and monitored by ransomware.live; the post says operations associated with azpropaint[.]com were impacted, but the claim is unconfirmed.
A post attributed to thegentlemen claims a ransomware incident involving Venezuelan logistics firm CHX Express and says its services were disrupted; the claim is unconfirmed.
Ransomware[.]live lists DEVCO Sp. z o.o. as a claimed target of thegentlemen; the post alleges ransomware impacts, but says the group’s claims cannot be confirmed.
Ransomware.live records a krybit claim targeting eclagestio360[.]com, a Spanish business management provider, involving ECLAGESTI,Ã ransomware. The claim was published May 9, 2026, and is unconfirmed.
A ransomware.live record attributes a claim involving Rain Makers Solutions to the Genesis ransomware actor. The post says the information is based on public group claims and has not been confirmed.
A ransomware.live post attributes a claim against Dayton firm Van Atta Engineering to the Genesis ransomware group. The post says systems were disrupted, but notes the claim is unconfirmed.
A ransomware.live-monitored post attributes a claim about Prescott & Holden to the Genesis ransomware group and cites its leak-site listing. The information is unconfirmed.
A ransomware claim attributed to Genesis names the American Board of Preventive Medicine as a victim. The post cites a leak-site listing but says the claim is unconfirmed.
A ransomware claim attributed to genesis names CarePoint Health and says systems associated with its affiliated physicians were affected. The post says the claim is unconfirmed.
A ransomware.live monitoring post attributes a ransomware incident involving Hillside Lumber to thegentlemen. The post says it is based on the group’s public claim, which it cannot confirm.
Ransomware.live lists DermaPharm, a Danish skincare manufacturer, in a ransomware claim attributed to thegentlemen. The post says the claim is unconfirmed.
Ransomware.live lists Ruiz Barbarin Arquitectos Slp, a Spanish construction firm, as a Qilin ransomware victim. The post attributes claims of file encryption, operational disruption, data loss and business interruption to Qilin; the claims are unverified.
A ransomware.live-monitored listing attributes a ransomware claim against DL Cohen Construction to Qilin. The post alleges encryption and operational disruption but says the claims are unconfirmed.
A ransomware.live monitoring post attributes a ransomware claim about CCD Interiors in Great Britain to Qilin. The post says the claim is based on the group’s public statements and is unconfirmed.
