Threat-actor trackers
The ransomware and extortion crews behind the breaches we cover — who they are, how active they've been, and every incident we've attributed to them. Each tracker grows automatically as our daily breach ingest picks up new claims.
Most active crews
LockBit
Latest: Bancroft Engineering Listed by LockBit
Qilin
Latest: Spoonful of Comfort Listed by Qilin Ransomware Group
Akira
Latest: Cozad Asset Management Listed by Akira Ransomware Group
Clop
Latest: Zebra.Com Listed by Clop Ransomware Group
Play
Latest: MIE Solutions Listed by Play Ransomware Group
INC Ransom
Latest: Otter Tail County, Minnesota Listed by Inc Ransom Ransomware Group
Ransomhub
Latest: Universidad Nacional Autónoma de México Listed by ransomhub Ransomware Group
The Gentlemen
Latest: The Coffee Bean Listed by The Gentlemen Ransomware Group
Alphv
Latest: Banco Sol Listed by alphv Ransomware Group
DragonForce
Latest: Vermont XCenter Listed by Dragonforce Ransomware Group
SafePay
Latest: granjarinya.com Listed by Safepay Ransomware Group
Blackbasta
Latest: bnext.nl Listed by blackbasta Ransomware Group
Medusa
Latest: Comune di Battipaglia Listed by medusa Ransomware Group
Bianlian
Latest: Collins Aerospace (An RTX Business) Listed by bianlian Ransomware Group
8base
Latest: St. Nicholas School Listed by 8base Ransomware Group
Lynx
Latest: www.talbotdes.org Listed by lynx Ransomware Group
Everest
Latest: Ingersoll Rand Listed by Everest Ransomware Group
Conti
Latest: Sangoma Technologies Corporation Listed by conti Ransomware Group
Lockbit5
Latest: vgrn.de Listed by lockbit5 Ransomware Group
Dispossessor
Latest: birdair.com Listed by dispossessor Ransomware Group
Nightspire
Latest: eas**** Listed by Nightspire Ransomware Group
Pysa
Latest: ΤÎΧÎÎÎÎÎÎÎÎ Î ÎÎÎÎ ÎΣΤÎÎÎÎ ÎΥΠΡÎÎ¥ Listed by pysa Ransomware Group
Hunters
Latest: Wrap & Send Services Listed by hunters Ransomware Group
Killsec
Latest: cashcowboy Listed by killsec Ransomware Group
Also tracking
Rhysida
Latest: Pierce Township Listed by Rhysida Ransomware Group
Sinobi
Latest: Neurotrials Research Inc Listed by sinobi Ransomware Group
Cactus
Latest: kyb.com Listed by cactus Ransomware Group
Royal
Latest: Braintree Public Schools Listed by royal Ransomware Group
Hive
Latest: R C Stevens Construction Listed by hive Ransomware Group
Ransomhouse
Latest: Nichirei Listed by Ransomhouse Ransomware Group
Stormous
Latest: BN: higuchi-inc Report Error & Warning Listed by stormous Ransomware Group
Fog
Latest: Newtown Friends School (newtownfriends.org) Listed by fog Ransomware Group
Vicesociety
Latest: SSV Architects Listed by vicesociety Ransomware Group
Blacksuit
Latest: Inns of Aurora Listed by blacksuit Ransomware Group
Devman
Latest: Encompass Listed by dragonforce Ransomware Group
Nova
Latest: SistNet Listed by nova Ransomware Group
Babuk2
Latest: tecnologias.mspz2.gob.ec Listed by babuk2 Ransomware Group
Coinbasecartel
Latest: Turner and Townsend Listed by coinbasecartel Ransomware Group
Worldleaks
Latest: PinnPACK Listed by worldleaks Ransomware Group
Handala
Latest: Aman Data Breach (2026)
Funksec
Latest: sorbonne-universite.fr Listed by funksec Ransomware Group
Cloak
Latest: ra-vogeler.de Listed by cloak Ransomware Group
Apt73
Latest: metrabyte.cloud Listed by apt73 Ransomware Group
Spacebears
Latest: SEARS (Grupo Sanborns) Listed by spacebears Ransomware Group
Blackbyte
Latest: Municipio de Chihuahua Listed by qilin Ransomware Group
Avaddon
Latest: Steel Art Signs Corp. Listed by avaddon Ransomware Group
Malas
Latest: Cosmos Hotel Group Listed by malas Ransomware Group
Meow
Latest: KLA Listed by meow Ransomware Group
ShinyHunters
Latest: Baxter International, Inc. Listed by shinyhunters Ransomware Group
Snatch
Latest: Apex Listed by blackbyte Ransomware Group
Sarcoma
Latest: GYF Listed by sarcoma Ransomware Group
Ragnarlocker
Latest: Scotbeef Ltd. - Leaks Listed by ragnarlocker Ransomware Group
Noescape
Latest: University of Hawaii Listed by noescape Ransomware Group
SilentRansomGroup
Latest: Reminger Listed by SilentRansomGroup Ransomware Group
Raworld
Latest: Watertown Public Schools Listed by raworld Ransomware Group
Interlock
Latest: Connell Enterprises LLC Listed by Interlock Ransomware Group
Toufan
Latest: maytronics.com Listed by toufan Ransomware Group
Krybit
Latest: hisstw.com Listed by Krybit Ransomware Group
ElDorado
Latest: Rees NDT Inspection Services Listed by ElDorado Ransomware Group
Genesis
Latest: Interim HealthCare Listed by Genesis Ransomware Group
Monti
Latest: American Eagle Logistics Listed by monti Ransomware Group
Payoutsking
Latest: Turner Listed by Payoutsking Ransomware Group
Pear
Latest: Sonitor Technologies Listed by pear Ransomware Group
Arcusmedia
Latest: Power Moendas Listed by arcusmedia Ransomware Group
Anubis
Latest: Interim HealthCare Listed by Anubis Ransomware Group
Cuba
Latest: dms-imaging Listed by cuba Ransomware Group
Deadlock
Latest: LT Group / Fortune Tobacco Listed by Deadlock Ransomware Group
Direwolf
Latest: AAM:HOA Management Listed by Direwolf Ransomware Group
Kairos
Latest: Hightech Signs Listed by Kairos Ransomware Group
Abyss
Latest: School Facility Consultants Listed by abyss Ransomware Group
Revil
Latest: kusd.edu Listed by revil Ransomware Group
Threeam
Latest: clubonecasino.com Listed by threeam Ransomware Group
How these trackers work
Our breach ingest monitors public reporting and ransomware leak sites daily. When an incident is claimed by or attributed to a named group, it's added to that group's tracker automatically. "Claimed by" is not proof — extortion crews sometimes exaggerate or recycle old data — so every entry links to the full write-up with sources.
If an organization you use appears here
Treat your data as circulating. Stolen records get scraped into the same broker-and-dump ecosystem that doxxers and identity thieves search. The fastest way to know your real exposure is a free breach scan — it checks your email against 13.1B+ leaked records in about 15 seconds, including data tied to the groups above.
Your email leaked. See who’s selling your address.
Nobody can unleak a breach. But the people-search sites selling your address because of it? Those come down. The free scan shows you which ones have you, in 15 seconds. Then you pick what fits.