Threat Actors
The ransomware crews and extortion groups behind recent data breaches — who they are, what they target, and every incident we link to them.
GDLockerSec5 trackedGDLockerSec is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.kryptos5 trackedkryptos is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.lockdata5 trackedlockdata is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.minteye5 trackedminteye is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.orca5 trackedorca is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.pandora5 trackedpandora is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.PrinzEugen5 trackedPrinzEugen is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.projectrelic5 trackedprojectrelic is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.raznatovic5 trackedraznatovic is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.secpo5 trackedsecpo is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ValenciaLeaks5 trackedValenciaLeaks is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Wallstreet5 trackedWallstreet is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.blacktor4 trackedblacktor is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.desolator4 trackeddesolator is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.exitium4 trackedexitium is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.linkc4 trackedlinkc is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ms130894 trackedms13089 is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ransomcortex4 trackedransomcortex is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.satanlockv24 trackedsatanlockv2 is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.shaoleaks4 trackedshaoleaks is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.blackshadow3 trackedblackshadow is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.bluebox3 trackedbluebox is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.bonacigroup3 trackedbonacigroup is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.coldlock3 trackedcoldlock is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.grief3 trackedgrief is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.