Threat Actors
The ransomware crews and extortion groups behind recent data breaches — who they are, what they target, and every incident we link to them.
siegedsec19 trackedsiegedsec is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.brotherhood18 trackedbrotherhood is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.d4rk4rmy18 trackedd4rk4rmy is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.mountlocker18 trackedmountlocker is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.trinity18 trackedtrinity is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ALP-00117 trackedALP-001 is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.sabbath17 trackedsabbath is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.apos16 trackedapos is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.datacarry16 trackeddatacarry is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.dunghill16 trackeddunghill is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.kawa409616 trackedkawa4096 is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.madliberator16 trackedmadliberator is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.mosesstaff16 trackedmosesstaff is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.redransomware16 trackedredransomware is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.tridentlocker16 trackedtridentlocker is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.unsafe16 trackedunsafe is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.AuditTeam15 trackedAuditTeam is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.azroteam15 trackedazroteam is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.cheers15 trackedcheers is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.nefilim15 trackednefilim is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.benzona14 trackedbenzona is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.freecivilian14 trackedfreecivilian is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.sparta14 trackedsparta is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.weyhro14 trackedweyhro is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.argonauts13 trackedargonauts is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.