Threat Actors
The ransomware crews and extortion groups behind recent data breaches — who they are, what they target, and every incident we link to them.
hellogookie3 trackedhellogookie is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.mnt63 trackedmnt6 is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.noname3 trackednoname is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ragnarok3 trackedragnarok is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.rebornvc3 trackedrebornvc is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.snake3 trackedsnake is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.TiMc3 trackedTiMc is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.trisec3 trackedtrisec is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.vanirgroup3 trackedvanirgroup is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.vendetta3 trackedvendetta is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.yurei3 trackedyurei is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.bitlocker2 trackedbitlocker is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Blackfield2 trackedBlackfield is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.cryptnet2 trackedcryptnet is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.kittykatkrew2 trackedkittykatkrew is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.lunalock2 trackedlunalock is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.nightsky2 trackednightsky is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.osiris2 trackedosiris is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.prolock2 trackedprolock is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Redact2 trackedRedact is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.sekhmet2 trackedsekhmet is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.sensayq2 trackedsensayq is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Triple X2 trackedTriple X is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.wastedlocker2 trackedwastedlocker is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.agelocker1 trackedagelocker is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.