m3rx Claims Theft of 120 GB From dmschweiz.ch
m3rx claims it stole 120 GB, comprising about 100,000 files, from dmschweiz[.]ch. The group also advertises catalogs of pre-installed devices and customizable installations. The claim is unconfirmed.
Ransom Monitor
Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2834 articles
LockBit5 Claims Ransomware Attack on St. Luke Lutheran Community
LockBit5 claims it encrypted systems at St. Luke Lutheran Community and threatens to leak data unless a ransom is paid. The claim is unconfirmed and was attributed to the actor’s leak-site post.
LockBit5 Claims Ransomware Attack on Instapack.es
LockBit5 claims it encrypted Instapack[.]es systems and exfiltrated sensitive data, demanding ransom and threatening publication or auction. The monitoring post says the claims are unconfirmed.
LockBit5 Claims Ransomware Incident at Pricon Microelectronics
LockBit5 is named in a ransomware claim against Pricon Microelectronics, Inc. in the Philippines. The post attributes the claim to the group's leak site and says it is unconfirmed; compromise, encryption, or exfiltration is not independently established.
LockBit5 Claims Planet Sport in Morocco as a Ransomware Victim
LockBit5 claims it compromised Planet Sport, an online sports store in Morocco, and threatens to encrypt data and leak sensitive information. The claim concerning planetsport[.]ma is unconfirmed.
LockBit 5 Claims Defcon5italy.com in Ransomware Listing
Ransomware.live lists an unverified LockBit 5 claim naming defcon5italy[.]com; the post says the information is based on the group's public claim and has not been confirmed.
Qilin Claims Construction Sciences in Unverified Ransomware Listing
A leak-site claim attributed to Qilin names Construction Sciences as a ransomware victim. ransomware[.]live records the claim; the article says it cannot confirm its accuracy.
Worldleaks Claims Mediaworks Kft in Hungary as a Ransomware Victim
A ransomware claim attributed to worldleaks lists Hungary-based Mediaworks Kft as a victim. The post cites the group’s leak site and says the claim is unconfirmed; no further incident details are available.
Qilin Claims KarmaData as a Ransomware Victim
A ransomware claim attributed to Qilin lists KarmaData, a US technology company, as a victim. The post was recorded on April 28, 2026; the claim is unconfirmed, and methods and impact are not provided.
Incransom Claims North Bay Distribution as a Ransomware Victim
A monitoring post says incransom listed North Bay Distribution as a ransomware victim. The post says the claim is unconfirmed and provides no verified impact details.
Incransom Claims 2 TB Data Exfiltration from Fulcrum RE
Incransom claims to have exfiltrated 2 TB of Fulcrum RE data. The claim is unverified; the post says it is based on the group’s public claim and invites an official response.
Chaos Claims Cadence Petroleum Faces 48-Hour Deadline Over Alleged 400 GB of Files
A leak-site post attributed to Chaos threatens to publish an alleged 400 GB of Cadence Petroleum files in 48 hours unless an agreement is reached. The claim is unconfirmed.
Everest Claims Ransomware Attack on Indonesia’s Customs Analytics Platform
A ransomware.live monitoring record attributes a ransomware claim against Indonesia’s Customs Analytics Platform to Everest. The post says the claim is unconfirmed; possible operational disruption is alleged.
Qilin Claims Silicon Alley as a Ransomware Victim
Ransomware.live reports that Qilin listed UK technology company Silicon Alley in a ransomware claim. The claim is unconfirmed; the post provides no details about a ransom or leaked data.
Insomnia Claims Ransomware Attack on Nephrology Associates, PA
Insomnia claims it encrypted patient records at Nephrology Associates, PA, across seven locations and threatens to leak or sell sensitive information if the ransom is not paid. The claim is unconfirmed.
WorldLeaks Claims Ransomware Attack on Carma Packaging
WorldLeaks claims it targeted Mexico-based Carma Packaging, alleging encrypted files and a ransom demand. The claim is attributed to the group's leak site and monitored by ransomware[.]live; the publisher says it cannot confirm the information.
SilentRansomGroup Claims Floyd Skeren Manukian Langevin, LLP as a Victim
A ransomware claim attributed to SilentRansomGroup names Floyd Skeren Manukian Langevin, LLP as a victim. The post says encryption and data exposure were alleged; the claims are unconfirmed.
WorldLeaks Claims Ransomware Operation Against Indonesian IT Provider Intikom
WorldLeaks claims it targeted Indonesian IT provider Intikom, alleging system encryption and potential data theft. The article says the claim is unconfirmed.
Krybit Claims Ransomware Attack on Moser-Spiel
Ransomware.live reports an unverified Krybit claim targeting Austrian outdoor-play equipment maker Moser-Spiel (moser-spiel[.]at); the post alleges encryption, possible data exfiltration and operational disruption, none independently confirmed.
Qilin Claims Lifeline PCS as Ransomware Victim
Qilin claims Lifeline PCS in the US as a ransomware victim, alleging file encryption and potential data exfiltration. The claim is attributed to the group, but independent verification is unavailable.
Everest Claims It Targeted Super AI in Ransomware Listing
A ransomware.live monitoring record says Everest claimed to target Super AI, encrypt files and demand payment for decryption. The claimed impact is not independently verified.
Everest Claims Ransomware Attack on Super AI
A Ransomware.live record attributes a ransomware attack claim against Super AI to Everest and cites the actor’s leak-site post. The claim is unconfirmed.
ShinyHunters Claims Vimeo Data Was Compromised, Threatens Leak
ShinyHunters claims Vimeo, Inc.’s Snowflake and BigQuery data was compromised via Anodot[.]com and demands payment, threatening to leak the data after an April 30, 2026 deadline. The claim is unconfirmed.
Incransom Claims Breach of sumacinc.com and Access to 2 TB of Client Data
The incransom ransomware group claims it breached sumacinc[.]com and accessed 2 TB of client data. The claim is unverified and attributed to its leak-site post, as tracked by ransomware[.]live.