Monitors ransomware victims, threat groups, leak-site activity, and newly disclosed ransomware incidents.
2834 articles
Worldleaks claims a ransomware attack against Birtcher Anderson & Davis. The claim is attributed to the group’s leak-site listing, but the incident is unconfirmed and no further details are provided.
APT73 claims it targeted Hargreaves Lansdown (hl[.]co[.]uk) in a ransomware incident. The monitoring post cites the group's leak-site listing and says the claim is unconfirmed.
The ransomware group apt73 allegedly claims exposure of Betclic[.]com online-betting users’ names, addresses, locations, email addresses and phone numbers in France; the post says the claim is unconfirmed.
Qilin claims ransomware activity against TokyoHosoKogyo Corporation in Japan. The post attributes the claim to the group’s leak site but says it cannot confirm the information; no incident details are provided.
DragonForce claimed it breached US technology firm ibswebsite[.]com; the monitoring post says encryption or data exfiltration and an extortion demand may be involved. The claim is unconfirmed.
A ransomware claim attributed to Qilin lists Exclusive Networks in France as the victim. The post provides no details on ransom demand, data exfiltration, or impact and says the claim is unconfirmed.
A ransomware claim attributed to Qilin lists Istarpal as a target. The post cites the group's leak site but provides no further incident details, and says the claim is unconfirmed.
A ransomware.live monitoring post says TridentLocker named UK broadcast technology provider RT Software in a ransomware claim. The claim is unconfirmed; impact and remediation details have not been disclosed.
A ransomware claim attributed to Payload names Manitoba’s Rural Municipality of Gimli. The post is linked to an actor source and monitored by ransomware.live; the claim has not been independently confirmed.
LockBit5 claimed a ransomware incident against Merlo, listing merlo[.]de on its leak site and threatening data exfiltration and ransom demands. The claim is unverified; no incident impact is independently confirmed.
LockBit 5 claims it compromised D. Heinrichs Logistic GmbH, a Bremerhaven logistics provider, and threatens to leak stolen data unless ransom is paid. The claim is attributed to the group’s leak-site post and is unconfirmed.
ransomware[.]live records an unverified LockBit 5 claim naming Bladex (bladex[.]com) as a victim and links to a LockBit post. The article says the claim’s accuracy cannot be confirmed.
DragonForce claims it breached Taiwan-based Synmosa Biopharma and says it will publish allegedly stolen data after an approximately 34-day countdown. The group claims the data totals 280.15 GB.
The Qilin group lists six alleged victims across several countries and industries. It claims data taken from Inspira includes medical records, identity documents, and other sensitive information.
Thegentlemen reportedly claimed Suzhou Yike Kejian Architectural Design Research Institute Co., Ltd. (Nanjing Branch) as a victim. The monitoring post says the claim is unconfirmed; it provides no incident details.
A monitoring post attributes to thegentlemen a claim of encryption and potential data exposure at Lawson Software (Thailand) Co., Ltd. The claims are unconfirmed; the record was monitored by ransomware[.]live.
Thegentlemen claim they breached Coralina, a Colombian government environmental authority, and demand a ransom to prevent data release. The claim is unconfirmed and attributed to the group.
A public ransomware claim by thegentlemen names Egypt-based EEC Group. The claim was recorded on April 26, 2026, and is unconfirmed; the post says it relies on the group’s claims.
LockBit5 claims it attacked Brazilian transport company ERS Transportes. The monitoring record attributes the claim to the group’s leak-site post; the claim is unconfirmed.
LockBit5 claims it breached BARDEHLE PAGENBERG via bardehle[.]com and exfiltrated confidential patent-litigation documents and other firm data. The post says the claim is unconfirmed.
LockBit5 allegedly targeted PT Murni Solusindo Nusantara in Indonesia, claiming data encryption and potential extortion. The claim is attributed to the group and remains unconfirmed.
LockBit5 claimed a ransomware attack against studiopiu[.]net, according to a ransomware.live monitoring post citing the group's leak-site listing. The publisher says the claim is unconfirmed.
Ransomware.live records an unconfirmed Qilin ransomware claim against KEMBA Indianapolis Credit Union, citing a Qilin leak-site post; no impact or additional incident details are available.
Qilin claims it breached Leistritz Turbine Technology in Germany, exfiltrated data, and demanded a ransom. The monitoring post says the claim is unconfirmed and provides no further attack details.
