Threat-actor trackers
The ransomware and extortion crews behind the breaches we cover — who they are, how active they've been, and every incident we've attributed to them. Each tracker grows automatically as our daily breach ingest picks up new claims.
Most active crews
LockBit
Latest: consilio.com Listed by LockBit Ransomware Group
Qilin
Latest: Dynamic Office Solutions Listed by Qilin Ransomware Group
Akira
Latest: DPL Group Listed by Akira Ransomware Group
Clop
Latest: Columbiabank.Com(Umpquabank.Com) Listed by Clop Ransomware Group
Play
Latest: Airtech Mechanical Services Listed by Play Ransomware Group
INC Ransom
Latest: Post Metal Recycling Listed by INC Ransom Ransomware Group
The Gentlemen
Latest: Zelham Listed by The Gentlemen Ransomware Group
Ransomhub
Latest: Universidad Nacional Autónoma de México Listed by RansomHub Ransomware Group
Alphv
Latest: Banco Sol Listed by ALPHV Ransomware Group
DragonForce
Latest: HEC Group Listed by DragonForce Ransomware Group
SafePay
Latest: wolfusofsky.de Listed by SafePay Ransomware Group
Blackbasta
Latest: bnext.nl Listed by Black Basta Ransomware Group
Medusa
Latest: Grandview Family Medicine Listed by Medusa Ransomware Group
Bianlian
Latest: Collins Aerospace (An RTX Business) Listed by BianLian Ransomware Group
8base
Latest: St. Nicholas School Listed by 8Base Ransomware Group
Lynx
Latest: cutlercapital Listed by Lynx Ransomware Group
Everest
Latest: Cenelec Listed by Everest Ransomware Group
Conti
Latest: Sangoma Technologies Corporation Listed by Conti Ransomware Group
Dispossessor
Latest: birdair.com Listed by Dispossessor Ransomware Group
NightSpire
Latest: C*ro *nty *es Listed by NightSpire Ransomware Group
Pysa
Latest: ΤÎΧÎÎÎÎÎÎÎÎ Î ÎÎÎÎ ÎΣΤÎÎÎÎ ÎΥΠΡÎÎ¥ Listed by PYSA Ransomware Group
Hunters
Latest: Wrap & Send Services Listed by Hunters Ransomware Group
Rhysida
Latest: clicks digital GmbH Information Listed by Rhysida Ransomware Group
KillSec
Latest: Giti Listed by KillSec Ransomware Group
Also tracking
Sinobi
Latest: Neurotrials Research Inc Listed by Sinobi Ransomware Group
Cactus
Latest: assaabloy.com Listed by Cactus Ransomware Group
RansomHouse
Latest: Terca Listed by RansomHouse Ransomware Group
Coinbase Cartel
Latest: Westwing Group SE NEW Listed by Coinbase Cartel Ransomware Group
Royal
Latest: Braintree Public Schools Listed by Royal Ransomware Group
Hive
Latest: R C Stevens Construction Listed by Hive Ransomware Group
Stormous
Latest: BN: higuchi-inc Report Error & Warning Listed by Stormous Ransomware Group
Fog
Latest: Newtown Friends School (newtownfriends.org) Listed by Fog Ransomware Group
Vicesociety
Latest: SSV Architects Listed by Vice Society Ransomware Group
Blacksuit
Latest: Inns of Aurora Listed by BlackSuit Ransomware Group
Devman
Latest: Encompass Listed by DragonForce Ransomware Group
Nova
Latest: SistNet Listed by Nova Ransomware Group
Babuk2
Latest: tecnologias.mspz2.gob.ec Listed by Babuk2 Ransomware Group
Worldleaks
Latest: PinnPACK Listed by World Leaks Ransomware Group
Handala
Latest: Aman Data Breach (2026)
Funksec
Latest: sorbonne-universite.fr Listed by FunkSec Ransomware Group
ShinyHunters
Latest: Warning Listed by ShinyHunters Ransomware Group
Cloak
Latest: ra-vogeler.de Listed by Cloak Ransomware Group
Krybit
Latest: Disk Precision Group Listed by Krybit Ransomware Group
Space Bears
Latest: Tomix / Grupo JOPER Listed by Space Bears Ransomware Group
Apt73
Latest: metrabyte.cloud Listed by APT73 Ransomware Group
SilentRansomGroup
Latest: S...d Listed by SilentRansomGroup Ransomware Group
Blackbyte
Latest: Municipio de Chihuahua Listed by Qilin Ransomware Group
Avaddon
Latest: Brown Robert LLP Listed by Avaddon Ransomware Group
Malas
Latest: Cosmos Hotel Group Listed by Malas Ransomware Group
Meow
Latest: KLA Listed by Meow Ransomware Group
Snatch
Latest: Apex Listed by BlackByte Ransomware Group
Sarcoma
Latest: GYF Listed by Sarcoma Ransomware Group
Direwolf
Latest: Hazel Health Listed by Direwolf Ransomware Group
Interlock
Latest: Blaise C. Bender, PC Listed by Interlock Ransomware Group
Ragnarlocker
Latest: Scotbeef Ltd. - Leaks Listed by Ragnar Locker Ransomware Group
Pear
Latest: Software Answers, a Banyan Software Listed by Pear Ransomware Group
Noescape
Latest: University of Hawaii Listed by NoEscape Ransomware Group
Genesis
Latest: Owens Distributors Listed by Genesis Ransomware Group
Raworld
Latest: Watertown Public Schools Listed by RA World Ransomware Group
Anubis
Latest: Gaedke & Partner Steuerberatung Listed by Anubis Ransomware Group
Arcus Media
Latest: Pantaneiro Capas Listed by Arcus Media Ransomware Group
Payoutsking
Latest: M****n Listed by Payoutsking Ransomware Group
Monti
Latest: American Eagle Logistics Listed by Monti Ransomware Group
Toufan
Latest: maytronics.com Listed by Toufan Ransomware Group
ElDorado
Latest: Rees NDT Inspection Services Listed by ElDorado Ransomware Group
Storm
Latest: West County Health Centers Listed by Storm Ransomware Group
Cuba
Latest: dms-imaging Listed by Cuba Ransomware Group
Deadlock
Latest: Shaheen Law Group Plc Listed by Deadlock Ransomware Group
Kairos
Latest: Slate Valley Unified School District Listed by Kairos Ransomware Group
Chaos
Latest: parkdental.com Listed by Chaos Ransomware Group
Medusalocker
Latest: Premiumfruits Listed by Medusalocker Ransomware Group
Threeam
Latest: stjames.wa.edu.au Listed by Threeam Ransomware Group
How these trackers work
Our breach ingest monitors public reporting and ransomware leak sites daily. When an incident is claimed by or attributed to a named group, it's added to that group's tracker automatically. "Claimed by" is not proof — extortion crews sometimes exaggerate or recycle old data — so every entry links to the full write-up with sources.
If an organization you use appears here
Treat your data as circulating. Stolen records get scraped into the same broker-and-dump ecosystem that doxxers and identity thieves search. The fastest way to know your real exposure is a free breach scan — it checks your email against 13.1B+ leaked records in about 15 seconds, including data tied to the groups above.
Your email leaked. See who’s selling your address.
Nobody can unleak a breach. But the people-search sites selling your address because of it? Those come down. The free scan shows you which ones have you, in 15 seconds. Then you pick what fits.