Threat Actors
The ransomware crews and extortion groups behind recent data breaches — who they are, what they target, and every incident we link to them.
astroteam1 trackedastroteam is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.blogxx1 trackedblogxx is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.cring1 trackedcring is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.crosslock1 trackedcrosslock is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.cry01 trackedcry0 is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.deathkitty1 trackeddeathkitty is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.dharma1 trackeddharma is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.hades1 trackedhades is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.insane1 trackedinsane is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.la_piovra1 trackedla_piovra is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.macaw1 trackedmacaw is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.mamba1 trackedmamba is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.maui1 trackedmaui is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.memedusalockerdusa1 trackedmemedusalockerdusa is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.nasirsecurity1 trackednasirsecurity is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.netflim1 trackednetflim is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.networm1 trackednetworm is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.phoenixcryptolocker1 trackedphoenixcryptolocker is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.playboy1 trackedplayboy is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ranstreet1 trackedranstreet is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.reynolds1 trackedreynolds is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.roadsweep1 trackedroadsweep is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.robinhood1 trackedrobinhood is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ronggolawe1 trackedronggolawe is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.secp01 trackedsecp0 is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.