Threat Actors
The ransomware crews and extortion groups behind recent data breaches — who they are, what they target, and every incident we link to them.
spacebears140 trackedspacebears is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ragnarlocker128 trackedragnarlocker is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.noescape126 trackednoescape is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.raworld123 trackedraworld is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.SilentRansomGroup117 trackedSilentRansomGroup is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.toufan117 trackedtoufan is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.interlock113 trackedinterlock is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ElDorado112 trackedElDorado is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.monti110 trackedmonti is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.payoutsking104 trackedpayoutsking is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.cuba103 trackedcuba is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.pear101 trackedpear is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.genesis99 trackedgenesis is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.arcusmedia98 trackedarcusmedia is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.anubis91 trackedanubis is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.abyss90 trackedabyss is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.revil89 trackedrevil is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.kairos88 trackedkairos is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.threeam87 trackedthreeam is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ransomexx86 trackedransomexx is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.lorenz78 trackedlorenz is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.medusalocker78 trackedmedusalocker is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.warlock78 trackedwarlock is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.cicada330175 trackedcicada3301 is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.direwolf75 trackeddirewolf is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.karakurt74 trackedkarakurt is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.avoslocker70 trackedavoslocker is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.beast70 trackedbeast is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.krybit70 trackedkrybit is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.quantum68 trackedquantum is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ransomed68 trackedransomed is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.BrainCipher66 trackedBrainCipher is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.payload65 trackedpayload is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.blacklock64 trackedblacklock is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.chaos64 trackedchaos is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.lv63 trackedlv is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.flocker59 trackedflocker is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.darkvault55 trackeddarkvault is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.losttrust53 trackedlosttrust is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.maze51 trackedmaze is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.tengu49 trackedtengu is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.trigona49 trackedtrigona is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.knight48 trackedknight is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.mallox48 trackedmallox is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.nitrogen48 trackednitrogen is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.crypto2446 trackedcrypto24 is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.termite46 trackedtermite is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.gunra45 trackedgunra is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.midas44 trackedmidas is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.blackshrantac43 trackedblackshrantac is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.