Ms13-089 — every breach we're tracking
Running log of incidents attributed to or claimed by Ms13-089 in public reporting, with what was exposed and what victims should do. Updated as new incidents are ingested.
Incidents tracked1
Latest activityAugust 15, 2026
TypeRansomware / extortion
Groups like Ms13-089 steal data first and extort second — and the stolen records rarely stay private. Once a victim organization's data hits a leak site, the personal details inside (names, emails, phones, addresses) get scraped into the same broker-and-dump ecosystem every doxxer searches. If an organization you've used appears below, treat your data as circulating.
Other crews we track
LockBit (3016)Qilin (2154)Akira (1549)Clop (1343)Play (1296)INC Ransom (915)Ransomhub (841)The Gentlemen (814)
All trackers →
Close the chain attack
Your email leaked. See who’s selling your address.
Nobody can unleak a breach. But the people-search sites selling your address because of it? Those come down. The free scan shows you which ones have you, in 15 seconds. Then you pick what fits.
Run my free scan
15 seconds · 13.1B+ records checked · no account, no card
W
Choose your protection level
COMPARE PLANS →
A one-time Deep Sweep, ongoing monitoring with weekly re-scans and breach alerts, or family-wide coverage — compare every plan and pick what fits.