Threat Actors
The ransomware crews and extortion groups behind recent data breaches — who they are, what they target, and every incident we link to them.
LockBit3339 trackedLockBit is one of the most active ransomware-as-a-service brands, known for fast encryption and a large affiliate network.lockbit32016 trackedlockbit3 is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Qilin1995 trackedQilin is a ransomware-as-a-service operation that encrypts victims and steals data for double-extortion, frequently hitting healthcare and manufacturing.Akira1543 trackedAkira is a ransomware group that targets mid-market companies, exfiltrating data before encryption and pressuring victims on a leak site.Play1275 trackedPlay is a ransomware group known for double-extortion attacks against businesses and public-sector organizations.clop1254 trackedclop is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.lockbit21000 trackedlockbit2 is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.INC Ransom871 trackedINC Ransom is a ransomware operation using double-extortion against a range of industries including healthcare and government.ransomhub841 trackedransomhub is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.alphv731 trackedalphv is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.DragonForce594 trackedDragonForce is a ransomware group that runs a leak site and targets enterprises for data theft and extortion.The Gentlemen593 trackedThe Gentlemen is a ransomware/extortion group that lists victims on its leak site and threatens to publish stolen data.bianlian534 trackedbianlian is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.blackbasta523 trackedblackbasta is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.SafePay518 trackedSafePay is a ransomware group using double-extortion against small and mid-sized organizations.medusa517 trackedmedusa is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.8base455 tracked8base is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.lynx413 trackedlynx is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.everest364 trackedeverest is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.conti351 trackedconti is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.dispossessor344 trackeddispossessor is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.lockbit5311 trackedlockbit5 is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.pysa309 trackedpysa is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.hunters306 trackedhunters is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.nightspire296 trackednightspire is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.killsec281 trackedkillsec is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.sinobi274 trackedsinobi is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.rhysida273 trackedrhysida is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.cactus248 trackedcactus is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.royal211 trackedroyal is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.hive208 trackedhive is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ransomhouse199 trackedransomhouse is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.fog189 trackedfog is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.stormous189 trackedstormous is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.vicesociety188 trackedvicesociety is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.devman184 trackeddevman is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.blacksuit183 trackedblacksuit is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.babuk2180 trackedbabuk2 is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.coinbasecartel175 trackedcoinbasecartel is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.handala175 trackedhandala is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.worldleaks173 trackedworldleaks is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.funksec172 trackedfunksec is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.cloak166 trackedcloak is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Nova163 trackedNova is a ransomware operation that steals and encrypts victim data and posts stolen files to pressure payment.apt73157 trackedapt73 is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ShinyHunters156 trackedShinyHunters is a prolific data-extortion group known for breaching large enterprises and leaking or selling stolen databases, often via compromised cloud and SaaS accounts.blackbyte147 trackedblackbyte is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.avaddon146 trackedavaddon is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.meow145 trackedmeow is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.malas144 trackedmalas is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.snatch142 trackedsnatch is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.sarcoma141 trackedsarcoma is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.spacebears140 trackedspacebears is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ragnarlocker128 trackedragnarlocker is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.noescape126 trackednoescape is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.raworld123 trackedraworld is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.SilentRansomGroup117 trackedSilentRansomGroup is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.toufan117 trackedtoufan is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.interlock113 trackedinterlock is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ElDorado112 trackedElDorado is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.monti110 trackedmonti is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.payoutsking104 trackedpayoutsking is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.cuba103 trackedcuba is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.pear101 trackedpear is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.genesis99 trackedgenesis is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.arcusmedia98 trackedarcusmedia is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.anubis91 trackedanubis is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.abyss90 trackedabyss is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.revil89 trackedrevil is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.kairos88 trackedkairos is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.threeam87 trackedthreeam is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ransomexx86 trackedransomexx is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.lorenz78 trackedlorenz is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.medusalocker78 trackedmedusalocker is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.warlock78 trackedwarlock is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.cicada330175 trackedcicada3301 is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.direwolf75 trackeddirewolf is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.karakurt74 trackedkarakurt is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.avoslocker70 trackedavoslocker is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.beast70 trackedbeast is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.krybit70 trackedkrybit is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.quantum68 trackedquantum is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ransomed68 trackedransomed is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.BrainCipher66 trackedBrainCipher is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.payload65 trackedpayload is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.blacklock64 trackedblacklock is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.chaos64 trackedchaos is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.lv63 trackedlv is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.flocker59 trackedflocker is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.darkvault55 trackeddarkvault is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.losttrust53 trackedlosttrust is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.maze51 trackedmaze is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.tengu49 trackedtengu is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.trigona49 trackedtrigona is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.knight48 trackedknight is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.mallox48 trackedmallox is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.nitrogen48 trackednitrogen is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.crypto2446 trackedcrypto24 is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.termite46 trackedtermite is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.gunra45 trackedgunra is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.midas44 trackedmidas is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.blackshrantac43 trackedblackshrantac is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.donutleaks42 trackeddonutleaks is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.AiLock41 trackedAiLock is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.J41 trackedJ is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.embargo40 trackedembargo is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.darkleakmarket39 trackeddarkleakmarket is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.dragonransomware39 trackeddragonransomware is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.insomnia37 trackedinsomnia is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.securotrop37 trackedsecurotrop is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ciphbit36 trackedciphbit is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.helldown36 trackedhelldown is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.nokoyawa36 trackednokoyawa is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.arvinclub35 trackedarvinclub is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.spook35 trackedspook is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.blacknevas34 trackedblacknevas is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.lamashtu34 trackedlamashtu is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.dAn0n33 trackeddAn0n is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.obscura33 trackedobscura is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.blackmatter32 trackedblackmatter is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.cmdorganization32 trackedcmdorganization is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.global32 trackedglobal is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.marketo32 trackedmarketo is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.suncrypt32 trackedsuncrypt is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.metaencryptor31 trackedmetaencryptor is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.moneymessage31 trackedmoneymessage is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.alphalocker30 trackedalphalocker is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.frag30 trackedfrag is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.payloadbin29 trackedpayloadbin is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.onyx28 trackedonyx is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.kelvinsecurity26 trackedkelvinsecurity is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.m3rx26 trackedm3rx is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.netwalker26 trackednetwalker is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.underground26 trackedunderground is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.werewolves26 trackedwerewolves is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.fulcrumsec25 trackedfulcrumsec is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.kraken25 trackedkraken is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.lapsus$25 trackedlapsus$ is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.vect25 trackedvect is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.doppelpaymer23 trackeddoppelpaymer is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.radar22 trackedradar is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ryuk22 trackedryuk is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.settra22 trackedsettra is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.aurora21 trackedaurora is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.daixin21 trackeddaixin is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.morpheus21 trackedmorpheus is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.xinglocker21 trackedxinglocker is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.bravox20 trackedbravox is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.hellcat20 trackedhellcat is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.leaktheanalyst20 trackedleaktheanalyst is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.cephalus19 trackedcephalus is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ralord19 trackedralord is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.siegedsec19 trackedsiegedsec is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.brotherhood18 trackedbrotherhood is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.d4rk4rmy18 trackedd4rk4rmy is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.mountlocker18 trackedmountlocker is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.trinity18 trackedtrinity is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ALP-00117 trackedALP-001 is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.sabbath17 trackedsabbath is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.apos16 trackedapos is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.datacarry16 trackeddatacarry is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.dunghill16 trackeddunghill is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.kawa409616 trackedkawa4096 is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.madliberator16 trackedmadliberator is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.mosesstaff16 trackedmosesstaff is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.redransomware16 trackedredransomware is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.tridentlocker16 trackedtridentlocker is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.unsafe16 trackedunsafe is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.AuditTeam15 trackedAuditTeam is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.azroteam15 trackedazroteam is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.cheers15 trackedcheers is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.nefilim15 trackednefilim is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.benzona14 trackedbenzona is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.freecivilian14 trackedfreecivilian is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.sparta14 trackedsparta is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.weyhro14 trackedweyhro is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.argonauts13 trackedargonauts is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.mindware13 trackedmindware is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.IMNCrew12 trackedIMNCrew is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ShadowByt3$12 trackedShadowByt3$ is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.teamxxx12 trackedteamxxx is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.cryp70n1c0d311 trackedcryp70n1c0d3 is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Icarus11 trackedIcarus is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.icefire11 trackedicefire is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.crazyhunter10 trackedcrazyhunter is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.darkpower10 trackeddarkpower is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.darkrace10 trackeddarkrace is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.darkside10 trackeddarkside is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Deadlock10 trackedDeadlock is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.blackout9 trackedblackout is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.groove9 trackedgroove is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.kazu9 trackedkazu is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.LeakBazaar9 trackedLeakBazaar is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.rook9 trackedrook is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.titan9 trackedtitan is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.babuk8 trackedbabuk is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.cryptbb8 trackedcryptbb is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.mogilevich8 trackedmogilevich is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.qiulong8 trackedqiulong is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.radiant8 trackedradiant is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.skira8 trackedskira is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.VanHelsing8 trackedVanHelsing is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.0mega7 tracked0mega is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.bert7 trackedbert is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.chort7 trackedchort is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.cyclops7 trackedcyclops is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.karma7 trackedkarma is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.malekteam7 trackedmalekteam is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.pay2key7 trackedpay2key is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.arkana6 trackedarkana is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.blackwater6 trackedblackwater is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Booba Project6 trackedBooba Project is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.cipherforce6 trackedcipherforce is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.dataleak6 trackeddataleak is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.egregor6 trackedegregor is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.netrunner6 trackednetrunner is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.rancoz6 trackedrancoz is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.redalert6 trackedredalert is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.RunSomeWares6 trackedRunSomeWares is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.silent6 trackedsilent is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.yanluowang6 trackedyanluowang is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.0day Syndicate5 tracked0day Syndicate is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.atomsilo5 trackedatomsilo is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Black X5 trackedBlack X is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.bqtlock5 trackedbqtlock is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.donex5 trackeddonex is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Doommageddon5 trackedDoommageddon is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.GDLockerSec5 trackedGDLockerSec is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.kryptos5 trackedkryptos is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.lockdata5 trackedlockdata is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.minteye5 trackedminteye is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.orca5 trackedorca is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.pandora5 trackedpandora is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.PrinzEugen5 trackedPrinzEugen is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.projectrelic5 trackedprojectrelic is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.raznatovic5 trackedraznatovic is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.secpo5 trackedsecpo is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ValenciaLeaks5 trackedValenciaLeaks is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Wallstreet5 trackedWallstreet is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.blacktor4 trackedblacktor is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.desolator4 trackeddesolator is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.exitium4 trackedexitium is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.linkc4 trackedlinkc is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ms130894 trackedms13089 is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ransomcortex4 trackedransomcortex is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.satanlockv24 trackedsatanlockv2 is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.shaoleaks4 trackedshaoleaks is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.blackshadow3 trackedblackshadow is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.bluebox3 trackedbluebox is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.bonacigroup3 trackedbonacigroup is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.coldlock3 trackedcoldlock is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.grief3 trackedgrief is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.hellogookie3 trackedhellogookie is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.mnt63 trackedmnt6 is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.noname3 trackednoname is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ragnarok3 trackedragnarok is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.rebornvc3 trackedrebornvc is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.snake3 trackedsnake is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.TiMc3 trackedTiMc is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.trisec3 trackedtrisec is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.vanirgroup3 trackedvanirgroup is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.vendetta3 trackedvendetta is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.yurei3 trackedyurei is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.bitlocker2 trackedbitlocker is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Blackfield2 trackedBlackfield is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.cryptnet2 trackedcryptnet is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.kittykatkrew2 trackedkittykatkrew is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.lunalock2 trackedlunalock is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.nightsky2 trackednightsky is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.osiris2 trackedosiris is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.prolock2 trackedprolock is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Redact2 trackedRedact is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.sekhmet2 trackedsekhmet is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.sensayq2 trackedsensayq is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Triple X2 trackedTriple X is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.wastedlocker2 trackedwastedlocker is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.agelocker1 trackedagelocker is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.astroteam1 trackedastroteam is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.blogxx1 trackedblogxx is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.cring1 trackedcring is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.crosslock1 trackedcrosslock is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.cry01 trackedcry0 is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.deathkitty1 trackeddeathkitty is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.dharma1 trackeddharma is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.hades1 trackedhades is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.insane1 trackedinsane is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.la_piovra1 trackedla_piovra is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.macaw1 trackedmacaw is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.mamba1 trackedmamba is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.maui1 trackedmaui is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.memedusalockerdusa1 trackedmemedusalockerdusa is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.nasirsecurity1 trackednasirsecurity is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.netflim1 trackednetflim is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.networm1 trackednetworm is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.phoenixcryptolocker1 trackedphoenixcryptolocker is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.playboy1 trackedplayboy is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ranstreet1 trackedranstreet is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.reynolds1 trackedreynolds is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.roadsweep1 trackedroadsweep is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.robinhood1 trackedrobinhood is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ronggolawe1 trackedronggolawe is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.secp01 trackedsecp0 is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.sicarii1 trackedsicarii is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.slug1 trackedslug is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.synack1 trackedsynack is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.thanos1 trackedthanos is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.walocker1 trackedwalocker is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.zeppelin1 trackedzeppelin is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.zerotolerance1 trackedzerotolerance is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.