Threat Actors
The ransomware crews and extortion groups behind recent data breaches — who they are, what they target, and every incident we link to them.
0mega7 tracked0mega is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.bert7 trackedbert is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.chort7 trackedchort is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.cyclops7 trackedcyclops is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.karma7 trackedkarma is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.malekteam7 trackedmalekteam is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.pay2key7 trackedpay2key is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.arkana6 trackedarkana is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.blackwater6 trackedblackwater is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Booba Project6 trackedBooba Project is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.cipherforce6 trackedcipherforce is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.dataleak6 trackeddataleak is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.egregor6 trackedegregor is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.netrunner6 trackednetrunner is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.rancoz6 trackedrancoz is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.redalert6 trackedredalert is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.RunSomeWares6 trackedRunSomeWares is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.silent6 trackedsilent is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.yanluowang6 trackedyanluowang is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.0day Syndicate5 tracked0day Syndicate is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.atomsilo5 trackedatomsilo is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Black X5 trackedBlack X is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.bqtlock5 trackedbqtlock is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.donex5 trackeddonex is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Doommageddon5 trackedDoommageddon is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.GDLockerSec5 trackedGDLockerSec is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.kryptos5 trackedkryptos is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.lockdata5 trackedlockdata is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.minteye5 trackedminteye is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.orca5 trackedorca is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.pandora5 trackedpandora is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.PrinzEugen5 trackedPrinzEugen is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.projectrelic5 trackedprojectrelic is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.raznatovic5 trackedraznatovic is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.secpo5 trackedsecpo is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ValenciaLeaks5 trackedValenciaLeaks is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Wallstreet5 trackedWallstreet is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.blacktor4 trackedblacktor is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.desolator4 trackeddesolator is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.exitium4 trackedexitium is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.linkc4 trackedlinkc is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ms130894 trackedms13089 is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ransomcortex4 trackedransomcortex is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.satanlockv24 trackedsatanlockv2 is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.shaoleaks4 trackedshaoleaks is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.blackshadow3 trackedblackshadow is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.bluebox3 trackedbluebox is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.bonacigroup3 trackedbonacigroup is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.coldlock3 trackedcoldlock is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.grief3 trackedgrief is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.hellogookie3 trackedhellogookie is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.mnt63 trackedmnt6 is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.noname3 trackednoname is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ragnarok3 trackedragnarok is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.rebornvc3 trackedrebornvc is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.snake3 trackedsnake is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.TiMc3 trackedTiMc is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.trisec3 trackedtrisec is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.vanirgroup3 trackedvanirgroup is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.vendetta3 trackedvendetta is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.yurei3 trackedyurei is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.bitlocker2 trackedbitlocker is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Blackfield2 trackedBlackfield is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.cryptnet2 trackedcryptnet is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.kittykatkrew2 trackedkittykatkrew is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.lunalock2 trackedlunalock is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.nightsky2 trackednightsky is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.osiris2 trackedosiris is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.prolock2 trackedprolock is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Redact2 trackedRedact is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.sekhmet2 trackedsekhmet is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.sensayq2 trackedsensayq is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Triple X2 trackedTriple X is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.wastedlocker2 trackedwastedlocker is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.agelocker1 trackedagelocker is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.astroteam1 trackedastroteam is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.blogxx1 trackedblogxx is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.cring1 trackedcring is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.crosslock1 trackedcrosslock is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.cry01 trackedcry0 is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.deathkitty1 trackeddeathkitty is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.dharma1 trackeddharma is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.hades1 trackedhades is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.insane1 trackedinsane is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.la_piovra1 trackedla_piovra is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.macaw1 trackedmacaw is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.mamba1 trackedmamba is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.maui1 trackedmaui is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.memedusalockerdusa1 trackedmemedusalockerdusa is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.nasirsecurity1 trackednasirsecurity is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.netflim1 trackednetflim is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.networm1 trackednetworm is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.phoenixcryptolocker1 trackedphoenixcryptolocker is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.playboy1 trackedplayboy is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ranstreet1 trackedranstreet is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.reynolds1 trackedreynolds is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.roadsweep1 trackedroadsweep is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.robinhood1 trackedrobinhood is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ronggolawe1 trackedronggolawe is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.secp01 trackedsecp0 is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.