Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2834 articles
A ransomware.live monitoring record says actor pear listed Beyond Measure & Associates, Inc. on its leak site. The claim is unverified, and the article provides no independent confirmation of an incident.
A ransomware.live record attributes an unconfirmed claim to Blackwater targeting Minidoka Memorial Hospital. The group claims the hospital’s data will be published after seven days.
Cmdorganization claims it targeted Zampell Ltd in Italy with a ransomware attack. The claim is attributed to the group and monitored by ransomware.live; the article says it cannot confirm the claim.
A ransomware.live monitoring post attributes an alleged ransomware attack on legal services company Epiq Global to Everest. The post says the claim is unconfirmed.
A ransomware.live post attributes to Everest an unverified claim that it targeted payment processor TSYS and encrypted systems and exfiltrated data. The article says it cannot confirm the claim.
Everest allegedly targeted Canadian business services company Symcor, with claims of operational disruption and potential client-data exposure. The claims are unconfirmed.
SafePay claims it carried out a ransomware incident against energyaction[.]com.au, warning of data leakage and service disruption. The claim, reported by ransomware.live, is unconfirmed.
A leak-site claim attributed to Krybit alleges it targeted Kenya’s Bomu Hospital, encrypting data and threatening to leak sensitive information unless a ransom is paid. The claim is unconfirmed.
Clop reportedly claimed a ransomware incident involving INJURYLAWYERS[.]COM, alleging system encryption and possible data exfiltration. The monitoring post says the claims are unconfirmed.
BlackNevas claims it stole data from MST (Sanko Makina and ASKO Holding) over seven months and encrypted the files. The post says the group demanded a starting price of 15 bitcoins; the claims are unconfirmed.
A ransomware claim record names The Country Club of Darien as a nightspire victim. The post lists several categories of business information, but says the group's claims are unconfirmed.
A ransomware.live record attributes a ransomware claim against Paramount Health Services & Insurance TPA Pvt. Ltd. to blacknevas. The post links to a leak-site entry and file listing but says the claims are unconfirmed.
BlackNevas claims it accessed 158,930+ files totaling 138+ GB of KINAS SOLICITORS client and company data. The monitoring post is based on the actor’s public claim, which the article says it cannot confirm.
BlackNevas claims it exfiltrated passports, company documents, and customer and employee records from Italy’s PROMOSFERA S.r.l.; ransomware[.]live records the claim, which the article says is unconfirmed.
Anubis reportedly claimed a ransomware attack on Colorado Dental Wellness Center, alleging exfiltration and encryption of clients’ medical data. The claim is unconfirmed.
Qilin claims it compromised MES Hybrid Document Systems in Canada, encrypted data and threatened to leak files unless a ransom is paid. The monitoring post says the claim is unconfirmed.
worldleaks claims it breached SMTA Sherwood Mutual Telephone Association and threatens data exposure and possible service disruption. The claim is attributed to the group and a monitoring service but is unconfirmed.
Ransomware.live says the group nova claimed Bimtrazer, an AI-driven BIM platform provider, on its leak site on April 30, 2026. The claim is unverified; no confirmation from Bimtrazer is provided.
Krybit claims it targeted German recruitment firm WEISS PM. The claim is listed by ransomware[.]live and attributed to Krybit’s leak site; the article says it cannot independently confirm the claim.
A ransomware.live listing names Morae as a target of an Everest claim alleging disruption and possible data exfiltration. It says Morae is assessing the incident and responding; the claims are unconfirmed.
Qilin claims it compromised and encrypted Jgb's systems in Colombia and demanded a ransom. The post says the claim is unverified and provides no further incident details.
A ransomware claim attributed to payoutsking names UK structural steelwork contractor Caunton Engineering. The article says the claim is unconfirmed and identifies ransomware.live as the monitoring service.
Ransomware[.]live lists Arban & Carosi as a victim claimed by Incransom, citing the group’s disclosure page dated April 30, 2026. The post is unconfirmed; the article says it cannot verify the claim.
Ransomware group m3rx claims it stole 480 GB across about 299,000 files from Anvil Arts; the monitoring post says the claim is unconfirmed.
