Threat Actors
The ransomware crews and extortion groups behind recent data breaches — who they are, what they target, and every incident we link to them.
donutleaks42 trackeddonutleaks is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.AiLock41 trackedAiLock is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.J41 trackedJ is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.embargo40 trackedembargo is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.darkleakmarket39 trackeddarkleakmarket is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.dragonransomware39 trackeddragonransomware is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.insomnia37 trackedinsomnia is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.securotrop37 trackedsecurotrop is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ciphbit36 trackedciphbit is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.helldown36 trackedhelldown is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.nokoyawa36 trackednokoyawa is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.arvinclub35 trackedarvinclub is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.spook35 trackedspook is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.blacknevas34 trackedblacknevas is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.lamashtu34 trackedlamashtu is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.dAn0n33 trackeddAn0n is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.obscura33 trackedobscura is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.blackmatter32 trackedblackmatter is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.cmdorganization32 trackedcmdorganization is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.global32 trackedglobal is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.marketo32 trackedmarketo is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.suncrypt32 trackedsuncrypt is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.metaencryptor31 trackedmetaencryptor is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.moneymessage31 trackedmoneymessage is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.alphalocker30 trackedalphalocker is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.