Threat-actor trackers
The ransomware and extortion crews behind the breaches we cover — who they are, how active they've been, and every incident we've attributed to them. Each tracker grows automatically as our daily breach ingest picks up new claims.
Most active crews
LockBit
Latest: Bancroft Engineering Listed by LockBit
Qilin
Latest: Nolan Consulting Group Listed by Qilin Ransomware Group
Akira
Latest: Stransky Heiz-Mess-Regeltechnik GmbH Listed by Akira Ransomware Group
Clop
Latest: Zebra.Com Listed by Clop Ransomware Group
Play
Latest: Figgins Family Wine Estates Listed by Play Ransomware Group
The Gentlemen
Latest: Lider Aviacao Listed by The Gentlemen Ransomware Group
INC Ransom
Latest: myglobal.com Listed by INC Ransom Ransomware Group
Ransomhub
Latest: Universidad Nacional Autónoma de México Listed by ransomhub Ransomware Group
Alphv
Latest: Banco Sol Listed by alphv Ransomware Group
DragonForce
Latest: Homewood Sales Listed by DragonForce Ransomware Group
SafePay
Latest: industry.airliquide.kr Listed by Safepay Ransomware Group
Blackbasta
Latest: bnext.nl Listed by blackbasta Ransomware Group
Medusa
Latest: Comune di Battipaglia Listed by medusa Ransomware Group
Bianlian
Latest: Collins Aerospace (An RTX Business) Listed by bianlian Ransomware Group
8base
Latest: St. Nicholas School Listed by 8base Ransomware Group
Lynx
Latest: cutlercapital Listed by Lynx Ransomware Group
Everest
Latest: Negotiation Rules Listed by Everest Ransomware Group
Lockbit5
Latest: huisartsencentrumkleiniterson.nl Listed by Lockbit5 Ransomware Group
Conti
Latest: Sangoma Technologies Corporation Listed by conti Ransomware Group
Dispossessor
Latest: birdair.com Listed by dispossessor Ransomware Group
NightSpire
Latest: Transportes Montejo S.A.S. Listed by NightSpire Ransomware Group
Pysa
Latest: ΤÎΧÎÎÎÎÎÎÎÎ Î ÎÎÎÎ ÎΣΤÎÎÎÎ ÎΥΠΡÎÎ¥ Listed by pysa Ransomware Group
Hunters
Latest: Wrap & Send Services Listed by hunters Ransomware Group
Killsec
Latest: Global Go Listed by killsec Ransomware Group
Also tracking
Rhysida
Latest: Szechenyi Programiroda Nonprofit Kf Listed by Rhysida Ransomware Group
Sinobi
Latest: Neurotrials Research Inc Listed by sinobi Ransomware Group
Cactus
Latest: kyb.com Listed by cactus Ransomware Group
Royal
Latest: Braintree Public Schools Listed by royal Ransomware Group
Hive
Latest: R C Stevens Construction Listed by hive Ransomware Group
Ransomhouse
Latest: REXT Holdings Co., Ltd. Listed by Ransomhouse Ransomware Group
Coinbasecartel
Latest: Westwing Group SE Listed by coinbasecartel Ransomware Group
Stormous
Latest: BN: higuchi-inc Report Error & Warning Listed by stormous Ransomware Group
Fog
Latest: Newtown Friends School (newtownfriends.org) Listed by fog Ransomware Group
Vicesociety
Latest: SSV Architects Listed by vicesociety Ransomware Group
Blacksuit
Latest: Inns of Aurora Listed by blacksuit Ransomware Group
Devman
Latest: Encompass Listed by dragonforce Ransomware Group
Nova
Latest: SistNet Listed by nova Ransomware Group
Babuk2
Latest: tecnologias.mspz2.gob.ec Listed by babuk2 Ransomware Group
Worldleaks
Latest: St. Francis Xavier Catholic School System Listed by worldleaks Ransomware Group
Handala
Latest: Aman Data Breach (2026)
Funksec
Latest: sorbonne-universite.fr Listed by funksec Ransomware Group
Cloak
Latest: ra-vogeler.de Listed by cloak Ransomware Group
Apt73
Latest: metrabyte.cloud Listed by apt73 Ransomware Group
ShinyHunters
Latest: Note to mr. databroker1 NEXUS DL Service Listed by ShinyHunters Ransomware Group
Spacebears
Latest: D-MAX Engineering, Inc Listed by Space Bears Ransomware Group
Krybit
Latest: ligacancerguate.org Listed by Krybit Ransomware Group
Blackbyte
Latest: Municipio de Chihuahua Listed by qilin Ransomware Group
Avaddon
Latest: Steel Art Signs Corp. Listed by avaddon Ransomware Group
SilentRansomGroup
Latest: H... C... Listed by SilentRansomGroup Ransomware Group
Malas
Latest: Cosmos Hotel Group Listed by malas Ransomware Group
Meow
Latest: KLA Listed by meow Ransomware Group
Snatch
Latest: Apex Listed by blackbyte Ransomware Group
Sarcoma
Latest: GYF Listed by sarcoma Ransomware Group
Direwolf
Latest: eAssist Dental Solutions Listed by Direwolf Ransomware Group
Ragnarlocker
Latest: Scotbeef Ltd. - Leaks Listed by ragnarlocker Ransomware Group
Noescape
Latest: University of Hawaii Listed by noescape Ransomware Group
Interlock
Latest: Super Systems Inc Listed by Interlock Ransomware Group
Pear
Latest: Kovo Healthtech Listed by Pear Ransomware Group
Raworld
Latest: Watertown Public Schools Listed by raworld Ransomware Group
Toufan
Latest: maytronics.com Listed by toufan Ransomware Group
Genesis
Latest: S******* Listed by genesis Ransomware Group
ElDorado
Latest: Rees NDT Inspection Services Listed by ElDorado Ransomware Group
Payoutsking
Latest: Proliance Surgeons Listed by payoutsking Ransomware Group
Anubis
Latest: Marlborough Partners Listed by Anubis Ransomware Group
Monti
Latest: American Eagle Logistics Listed by monti Ransomware Group
Arcusmedia
Latest: Mark’Techno Listed by arcusmedia Ransomware Group
Cuba
Latest: dms-imaging Listed by cuba Ransomware Group
Deadlock
Latest: Shaheen Law Group Plc Listed by Deadlock Ransomware Group
Kairos
Latest: Ville de Libercourt Listed by Kairos Ransomware Group
Abyss
Latest: Memsic Listed by Abyss Ransomware Group
Threeam
Latest: wmdn.net Listed by threeam Ransomware Group
Chaos
Latest: evergenbio.com Listed by Chaos Ransomware Group
How these trackers work
Our breach ingest monitors public reporting and ransomware leak sites daily. When an incident is claimed by or attributed to a named group, it's added to that group's tracker automatically. "Claimed by" is not proof — extortion crews sometimes exaggerate or recycle old data — so every entry links to the full write-up with sources.
If an organization you use appears here
Treat your data as circulating. Stolen records get scraped into the same broker-and-dump ecosystem that doxxers and identity thieves search. The fastest way to know your real exposure is a free breach scan — it checks your email against 13.1B+ leaked records in about 15 seconds, including data tied to the groups above.
Your email leaked. See who’s selling your address.
Nobody can unleak a breach. But the people-search sites selling your address because of it? Those come down. The free scan shows you which ones have you, in 15 seconds. Then you pick what fits.