Threat Actors
The ransomware crews and extortion groups behind recent data breaches — who they are, what they target, and every incident we link to them.
frag30 trackedfrag is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.payloadbin29 trackedpayloadbin is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.onyx28 trackedonyx is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.kelvinsecurity26 trackedkelvinsecurity is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.m3rx26 trackedm3rx is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.netwalker26 trackednetwalker is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.underground26 trackedunderground is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.werewolves26 trackedwerewolves is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.fulcrumsec25 trackedfulcrumsec is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.kraken25 trackedkraken is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.lapsus$25 trackedlapsus$ is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.vect25 trackedvect is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.doppelpaymer23 trackeddoppelpaymer is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.radar22 trackedradar is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ryuk22 trackedryuk is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.settra22 trackedsettra is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.aurora21 trackedaurora is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.daixin21 trackeddaixin is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.morpheus21 trackedmorpheus is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.xinglocker21 trackedxinglocker is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.bravox20 trackedbravox is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.hellcat20 trackedhellcat is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.leaktheanalyst20 trackedleaktheanalyst is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.cephalus19 trackedcephalus is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ralord19 trackedralord is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.