Threat Actors
The ransomware crews and extortion groups behind recent data breaches — who they are, what they target, and every incident we link to them.
rhysida273 trackedrhysida is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.cactus248 trackedcactus is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.royal211 trackedroyal is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.hive208 trackedhive is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ransomhouse199 trackedransomhouse is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.fog189 trackedfog is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.stormous189 trackedstormous is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.vicesociety188 trackedvicesociety is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.devman184 trackeddevman is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.blacksuit183 trackedblacksuit is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.babuk2180 trackedbabuk2 is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.coinbasecartel175 trackedcoinbasecartel is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.handala175 trackedhandala is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.worldleaks173 trackedworldleaks is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.funksec172 trackedfunksec is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.cloak166 trackedcloak is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Nova163 trackedNova is a ransomware operation that steals and encrypts victim data and posts stolen files to pressure payment.apt73157 trackedapt73 is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ShinyHunters156 trackedShinyHunters is a prolific data-extortion group known for breaching large enterprises and leaking or selling stolen databases, often via compromised cloud and SaaS accounts.blackbyte147 trackedblackbyte is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.avaddon146 trackedavaddon is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.meow145 trackedmeow is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.malas144 trackedmalas is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.snatch142 trackedsnatch is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.sarcoma141 trackedsarcoma is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.