Skip to content
← All breaches
Threat actor tracker 8 incidents tracked

Helix — every breach we're tracking

Running log of incidents attributed to or claimed by Helix in public reporting, with what was exposed and what victims should do. Updated as new incidents are ingested.

Incidents tracked8
Latest activityAugust 22, 2026
TypeRansomware / extortion

Groups like Helix steal data first and extort second — and the stolen records rarely stay private. Once a victim organization's data hits a leak site, the personal details inside (names, emails, phones, addresses) get scraped into the same broker-and-dump ecosystem every doxxer searches. If an organization you've used appears below, treat your data as circulating.

Tracked incidents

high August 22, 2026

AmSpec Listed by Helix Ransomware Group

AmSpec is live. T1 unlocks on the current 24-hour cadence, then 24 hours per remaining tier.…

high August 19, 2026

Delek US Listed by Helix Ransomware Group

Delek US is live. T1 unlocks in 12 hours, then 24 hours per remaining tier.…

high August 16, 2026

Kennedy Jenks Listed by Helix Ransomware Group

Kennedy Jenks is live. T1 is unlocked. T2 in 24 hours, then one day each through T4.…

high August 06, 2026

Highwoods Properties Listed by Helix Ransomware Group

SharePoint libraries staged T1 (least) → T4 (most). Release countdown live on Helix. Tiers unlock by stage when each set timer reaches 0.…

high August 06, 2026

Uber Listed by Helix Ransomware Group

SharePoint libraries staged T1 (least) → T4 (most). Release countdown live on Helix. Tiers unlock by stage when each set timer reaches 0.…

high August 06, 2026

Morguard Listed by Helix Ransomware Group

Morguard reached out, took extensions, then ignored the negotiation with no real offer. Contacting us and stalling is not a strategy. Deadli…

high August 06, 2026

Westland Insurance Listed by Helix Ransomware Group

Westland reached out, got the full demand, then stalled with no serious number. Contacting us and dragging process is not negotiation.…

high August 06, 2026

Venture Logistics Listed by Helix Ransomware Group

SharePoint libraries staged T1 (least) → T4 (most). Release countdown live on Helix. Tiers unlock by stage when each set timer reaches 0.…

Close the chain attack

Your email leaked. See who’s selling your address.

Nobody can unleak a breach. But the people-search sites selling your address because of it? Those come down. The free scan shows you which ones have you, in 15 seconds. Then you pick what fits.

Run my free scan
15 seconds · 13.1B+ records checked · no account, no card
W Choose your protection level COMPARE PLANS →
The full report on what your scan found, ongoing monitoring with weekly re-scans and breach alerts, or family-wide coverage — compare every plan and pick what fits.