Threat Actors
The ransomware crews and extortion groups behind recent data breaches — who they are, what they target, and every incident we link to them.
mindware13 trackedmindware is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.IMNCrew12 trackedIMNCrew is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ShadowByt3$12 trackedShadowByt3$ is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.teamxxx12 trackedteamxxx is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.cryp70n1c0d311 trackedcryp70n1c0d3 is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Icarus11 trackedIcarus is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.icefire11 trackedicefire is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.crazyhunter10 trackedcrazyhunter is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.darkpower10 trackeddarkpower is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.darkrace10 trackeddarkrace is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.darkside10 trackeddarkside is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Deadlock10 trackedDeadlock is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.blackout9 trackedblackout is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.groove9 trackedgroove is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.kazu9 trackedkazu is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.LeakBazaar9 trackedLeakBazaar is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.rook9 trackedrook is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.titan9 trackedtitan is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.babuk8 trackedbabuk is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.cryptbb8 trackedcryptbb is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.mogilevich8 trackedmogilevich is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.qiulong8 trackedqiulong is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.radiant8 trackedradiant is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.skira8 trackedskira is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.VanHelsing8 trackedVanHelsing is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.