Threat Actors
The ransomware crews and extortion groups behind recent data breaches — who they are, what they target, and every incident we link to them.
donutleaks42 trackeddonutleaks is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.AiLock41 trackedAiLock is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.J41 trackedJ is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.embargo40 trackedembargo is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.darkleakmarket39 trackeddarkleakmarket is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.dragonransomware39 trackeddragonransomware is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.insomnia37 trackedinsomnia is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.securotrop37 trackedsecurotrop is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ciphbit36 trackedciphbit is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.helldown36 trackedhelldown is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.nokoyawa36 trackednokoyawa is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.arvinclub35 trackedarvinclub is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.spook35 trackedspook is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.blacknevas34 trackedblacknevas is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.lamashtu34 trackedlamashtu is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.dAn0n33 trackeddAn0n is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.obscura33 trackedobscura is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.blackmatter32 trackedblackmatter is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.cmdorganization32 trackedcmdorganization is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.global32 trackedglobal is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.marketo32 trackedmarketo is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.suncrypt32 trackedsuncrypt is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.metaencryptor31 trackedmetaencryptor is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.moneymessage31 trackedmoneymessage is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.alphalocker30 trackedalphalocker is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.frag30 trackedfrag is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.payloadbin29 trackedpayloadbin is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.onyx28 trackedonyx is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.kelvinsecurity26 trackedkelvinsecurity is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.m3rx26 trackedm3rx is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.netwalker26 trackednetwalker is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.underground26 trackedunderground is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.werewolves26 trackedwerewolves is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.fulcrumsec25 trackedfulcrumsec is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.kraken25 trackedkraken is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.lapsus$25 trackedlapsus$ is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.vect25 trackedvect is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.doppelpaymer23 trackeddoppelpaymer is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.radar22 trackedradar is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ryuk22 trackedryuk is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.settra22 trackedsettra is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.aurora21 trackedaurora is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.daixin21 trackeddaixin is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.morpheus21 trackedmorpheus is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.xinglocker21 trackedxinglocker is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.bravox20 trackedbravox is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.hellcat20 trackedhellcat is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.leaktheanalyst20 trackedleaktheanalyst is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.cephalus19 trackedcephalus is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ralord19 trackedralord is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.siegedsec19 trackedsiegedsec is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.brotherhood18 trackedbrotherhood is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.d4rk4rmy18 trackedd4rk4rmy is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.mountlocker18 trackedmountlocker is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.trinity18 trackedtrinity is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ALP-00117 trackedALP-001 is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.sabbath17 trackedsabbath is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.apos16 trackedapos is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.datacarry16 trackeddatacarry is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.dunghill16 trackeddunghill is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.kawa409616 trackedkawa4096 is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.madliberator16 trackedmadliberator is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.mosesstaff16 trackedmosesstaff is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.redransomware16 trackedredransomware is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.tridentlocker16 trackedtridentlocker is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.unsafe16 trackedunsafe is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.AuditTeam15 trackedAuditTeam is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.azroteam15 trackedazroteam is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.cheers15 trackedcheers is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.nefilim15 trackednefilim is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.benzona14 trackedbenzona is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.freecivilian14 trackedfreecivilian is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.sparta14 trackedsparta is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.weyhro14 trackedweyhro is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.argonauts13 trackedargonauts is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.mindware13 trackedmindware is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.IMNCrew12 trackedIMNCrew is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.shadowbyt3$12 trackedshadowbyt3$ is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.teamxxx12 trackedteamxxx is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.cryp70n1c0d311 trackedcryp70n1c0d3 is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Icarus11 trackedIcarus is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.icefire11 trackedicefire is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.crazyhunter10 trackedcrazyhunter is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.darkpower10 trackeddarkpower is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.darkrace10 trackeddarkrace is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.darkside10 trackeddarkside is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Deadlock10 trackedDeadlock is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.blackout9 trackedblackout is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.groove9 trackedgroove is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.kazu9 trackedkazu is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.LeakBazaar9 trackedLeakBazaar is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.rook9 trackedrook is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.titan9 trackedtitan is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.babuk8 trackedbabuk is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.cryptbb8 trackedcryptbb is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.mogilevich8 trackedmogilevich is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.qiulong8 trackedqiulong is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.radiant8 trackedradiant is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.skira8 trackedskira is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.VanHelsing8 trackedVanHelsing is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.