d4 · tools · leaks
Who ransomware groups are claiming to have breached, from two independent trackers of their leak sites. Unverified criminal claims, not confirmed breaches: an early signal to go and check, never a finding. Get alerts when something on your watch list is claimed. We do not record what you look up.
Tracking 2,073 claims across 108 groups, 237 of them in the last seven days.
A listing means a criminal group has said it holds data from an organisation. It does not mean a breach happened, that the data is real, or that it is recent.
Where two independent trackers carried the same claim we mark it 2 sources. That means two crawlers saw the same post, not that anyone verified it.
We publish the claim only. We do not link to leak sites, mirror screenshots, or carry any pointer to stolen data. If you are listed here and believe it is wrong, or you want the entry removed, tell us and we will act on it.
None of this is our research. The crawling is done by RansomLook, Ransomfeed and ransomware.live, and we are grateful for it. Please go to them for the full picture.
| Organisation named | Group claiming | Claimed | Where | Sources |
|---|---|---|---|---|
| Quy Nhon University Quy Nhon University (QNU) is a public, multidisciplinary university located in Quy Nhon City, Binh Dinh Province, Vietnam. Established in 1977, the university has a long-standing tradition in teacher education and has developed into a comprehensive institution... | vexy | 2026-09-19 | — | ransomlook |
| Cassias MG Government network commitment, from government credentials to justice panels, such as access to the financial sector, police, personal data, medical (SUS), RG(CIN), BIRTH CERTIFICATE, CPF (identity number in Brazil) among other data from CASSIAS.MG.GOV departments, we wi... | emperador | 2026-09-19 | BR, Government & Defense | 2 sources |
| K3G Solutions Brazil K3G Solutions is a Brazilian telecom/IT consulting company based in Manaus, providing network engineering, ISP support, monitoring, call-center, CDN, and colocation services. | Panzer | 2026-09-18 | BR, Other | ransomwarelive |
| Vista Plastic Solutions vistahelps.com Canada | play | 2026-09-18 | US, Manufacturing | 2 sources |
| Inglewood Golf inglewoodgolfclub.ca Canada | play | 2026-09-18 | CA, Hospitality | 2 sources |
| Barrett Mahony Consulting Engineers barrettmahony.com Ireland | play | 2026-09-18 | IE, Professional Services | 2 sources |
| PITTSRAD pittsrad.net [AVAILABLE DATA] Radiology and health imaging, client personal and health data. | Spirals | 2026-09-18 | US, Healthcare | ransomwarelive |
| Quest Group Employee data, internal files, and a few unexpected discoveries. | anubis | 2026-09-18 | Technology | 2 sources |
| Inter (Venezuela's largest internet provider) Telecommunications / ISP · Venezuela | Subscriber connection records: 15,300,000+ entries, tens of thousands of subscriber addresses with the services they contacted; Complete internal network map across all regional operations; Core infrastructure configurati... | N0n | 2026-09-18 | VE, Technology | ransomwarelive |
| Premier Lighting & Controls premierlight.com Premier Lighting & Controls is a full-service commercial lighting agency. It serves architects, contractors, distributors, building owners, and en... | Gammax | 2026-09-18 | US, Manufacturing | 2 sources |
| Paid Victim 192EB2B6AD7B98D9 [AI generated] N/A I don't have any reliable information about a company named "Paid Victim 192EB2B6AD7B98D9." This appears to be an anonymized or coded identifier, possibly from a ransomware leak site or threat intelligence feed, rather than an actual company... | AuditTeam | 2026-09-18 | RU, Not Found | ransomwarelive |
| AUDIT ENTITY: kit-e.jp AUDIT ID: 9CB29482AF73366B / DISCOVERY DATE: 2026-09-09 | audit team | 2026-09-18 | — | ransomlook |
| United Federation of Teachers uft.org Education / Labor Union · US — New York What will be published if no settlement is reached The union’s complete legal case archive — approx. 181,420 documents: grievance and arbitration files, disciplinary appeal decisions and personnel case files, each named... | N0n | 2026-09-18 | US, Education | 2 sources |
| Vietnamese betting operator (GC789 network / Boundless TE) Online gambling / agent platform · Vietnam / Switzerland What will be published if no settlement is reached The complete bettor database: 2,021,011 registered bettors with names, +84 phone numbers, email addresses, deposit and withdrawal amounts The full agent... | N0n | 2026-09-18 | VN, Other | 2 sources |
| BeLi Teacher / FSC education centers (AWS) beliteachers.com Education / edtech · Vietnam What will be published if no settlement is reached The complete CRM lead database: 152,044 contact records — names, emails, +84 phone numbers, cities, study interests, engagement history The CRM file archive (tasks, forums, comment... | N0n | 2026-09-18 | VN, Education | 2 sources |
| Konnatus (usucapião legal services) Legal services / real estate · Brazil What will be published if no settlement is reached The application database: chart of accounts, income/outflow structures, account types User accounts with password hashes Publication proceeds after the deadline. | N0n | 2026-09-18 | BR, Professional Services | 2 sources |
| STOKR (digital securities platform) stokr.io Digital securities / investment platform · Luxembourg - EU What will be published if no settlement is reached KYC investor register: full names, emails, countries, nationalities, wallet addresses and tax IDs where present Identity-to-crypto-wallet mapping of K... | N0n | 2026-09-18 | LU, Financial Services | 2 sources |
| AstraZeneca Türkiye astrazeneca.com.tr Pharmaceutical manufacturing (GxP) · Türkiye What will be published if no settlement is reached Complete internal network-security configuration of all 3 sites (940 MB): every rule, device definition, remote-access mappings 1.35M connection records: M365/Intun... | N0n | 2026-09-18 | TR, Healthcare | 2 sources |
| Argentem Creek Partners (investment firm) argentemcreek.com Investment management / private credit · United States What will be published if no settlement is reached Full corporate network evidence: 2.5M+ connection records, complete internal systems map (Active Directory, SharePoint, MSP tooling, office-security integ... | N0n | 2026-09-18 | US, Financial Services | 2 sources |
| Ministry of Education — Argentina argentina.gob.ar Government / education · Argentina What will be published if no settlement is reached Complete network-security configuration of the ministry network 1.08M connection records: national library (BNM), school-book selection platform, scholarship systems (becaspr... | N0n | 2026-09-18 | AR, Government & Defense | 2 sources |
| PayPal support operations (Transcom WorldWide) transcom.com Outsourced customer support / financial services · Netherlands / Tunisia What will be published if no settlement is reached 86.7M connection records: daily support-agent sessions into PayPal corporate Citrix/AAA systems Complete infrastructure map: internal AD... | N0n | 2026-09-18 | SE, Financial Services | 2 sources |
| Quy Nhon University qnu.edu.vn Quy Nhon University (QNU) is a public, multidisciplinary university located in Quy Nhon City, Binh Dinh Province, Vietnam. Established in 1977, the university has a long-standing tradition in teacher education and has developed into a comprehensive institution... | Vexy Ransomware | 2026-09-18 | VN, Education | ransomwarelive |
| MPA Pharma mpapharma.de MPA Pharma MPA Pharma GmbH is an internationally active, rapidly growing company specializing in the import and trade of high-quality pharmaceuticals, including both patented and generic products. 2,899,290 files, ~5.8 TBPharmaceutical companyCategories: accou... | rhysida | 2026-09-18 | DE, Healthcare | 2 sources |
| kendallhunt.com kendallhunt.com Founded in 1944, Kendall Hunt Publishing is a publisher of hands-on, inquiry-based science, mathematics, and gifted curricula for grades PreK-12. Their research and standards-based programs are available in both print and digital components that encompass stud... | incransom | 2026-09-18 | US, Education | 2 sources |
| roancampingholidays.com roancampingholidays.com Roan Luxury Camping Holidays is a Dutch tour operator specializing in deluxe mobile home and tent rentals at 4- and 5-star campsites across Europe | incransom | 2026-09-18 | NL, Hospitality | 2 sources |
| forus.cl forus.cl Founded in 1980 and headquartered in Santiago, Chile, Forus is a provider of apparel. The company pr... | lockbit5 | 2026-09-18 | CL, Professional Services | 2 sources |
| Ascend Com ascendcom.com.sg N/A | qilin | 2026-09-18 | SG, Technology | 2 sources |
| Ceres Tolvas cerestolvas.com.ar N/A | qilin | 2026-09-18 | AR, Agriculture and Food Production | 2 sources |
| Futuro Forestal futuroforestal.com N/A | qilin | 2026-09-18 | CL, Agriculture and Food Production | 2 sources |
| Grupo Juste grupojuste.com N/A | qilin | 2026-09-18 | MX, Other | 2 sources |
| Inland and Offshore Contractors iocltt.com N/A | qilin | 2026-09-18 | TT, Energy & Utilities | 2 sources |
| Accela.com accela.com Revenue: $144.4 million Accela is a comprehensive cloud based software platform used by state and local governments to manage internal agency operations. We have successfully extracted over 50 GB of data from Accela. Data includes over 2 million lines of user... | endzone | 2026-09-18 | US, Government & Defense | 2 sources |
| AT&T att.com Revenue: $125.6 billion Initial access was via a CX contractor doing business with AT&T. Access originally used as vehicle for Equipment Changes/Call Forwarding (thanks a lot TORCH patch) - VPN + HVD (both external and internal MyDesktop) instances were access... | endzone | 2026-09-18 | US, Technology | 2 sources |
| ANYTHINGIT anythingit.com Certified IT Asset Disposition (ITAD) and e-waste management for federal agencies, defense contractors, and enterprise organizations demanding the highest chain-of-custody standards. | spirals | 2026-09-18 | Technology | 2 sources |
| First Secure Community Bank 1stsecurebank.com First Secure Community Bank is a locally-owned financial institution based in Sugar Grove, Illinois, offering a range of personal and business banking services. Their product offerings include residential lending, personal and business credit cards, and intere... | storm | 2026-09-18 | US, Financial Services | 2 sources |
| The State Bank thestatebankgroup.com The State Bank Group is comprised of Wonder Lake State Bank (east), Wonder Lake State Bank (west), Johnsburg State Bank, Spring Grove State Bank, Lakemoor State Bank and Hebron State Bank. The company is proud to have directorship of local business owners and... | storm | 2026-09-18 | US, Financial Services | 2 sources |
| First Secure Bank and Trust firstsecurebank.com First Secure Bank and Trust was founded in Palos Hills, Illinois in 1977 to serve the financial needs of the company's friends and neighbors. Today, the company is still in the neighborhood and continuing with that mission. The company is the only "true" local... | storm | 2026-09-18 | US, Financial Services | 2 sources |
| American Casting Company americancastingco.com Manufacturing | Hollister, California, United States | American Casting Company is an ISO 9001 and AS9100 certified investment casting foundry located in Hollister, California, specializing in premier quality investment castings for the aerospace and medical i... | storm | 2026-09-18 | US, Manufacturing | 2 sources |
| Johnson Investment Counsel johnsoninv.com Johnson Investment Counsel is an independent, employee-owned wealth management firm founded in 1965 and headquartered in Cincinnati, Ohio. The company provides comprehensive financial services to individuals, families, businesses, corporations, retirement plan... | storm | 2026-09-18 | US, Financial Services | 2 sources |
| Giti Corp giti-corp.com [AI generated] N/A | killsec | 2026-09-18 | SG, Manufacturing | ransomwarelive |
| Stim stim.fr Stim France specializes in video surveillance solutions within the security industry. The company offers a range of video recorders, video receivers, storage expansion, and integration services for surveillance cameras, as well as software for video surveillan... | Panzer | 2026-09-18 | FR, Technology | ransomwarelive |
| Inovapy inovapy.com INOVAPY is a technology company specializing in software development and digital transformation solutions for small and medium-sized businesses, offering reliable and scalable technological services across Latin America and beyond. | Panzer | 2026-09-18 | PY, Technology | ransomwarelive |
| Anderson Industries anderson-industries.com Anderson Industries is a cutting-edge engineering and manufacturing company that assists forward-thinking businesses in bringing innovative products to market. They offer a range of productsincluding agricultural equipment, trailers, and foundry services.We wi... | akira | 2026-09-18 | US, Manufacturing | 2 sources |
| Prefix Corp prefix.com Status: AWAITING Size: 1135 GB | securotrop | 2026-09-18 | US, Other | 2 sources |
| Universitt Hamburg uni-hamburg.de Universität Hamburg is the largest research and educational institution in Northern Germany, with over 42,000 students. It offers a wide range of academic programs and is recognized for its excellence in research and teaching. The university serves diverse tar... | Panzer | 2026-09-17 | DE, Education | ransomwarelive |
| C... Redacted entry - full company name pending disclosure (FULL DATA TIMER active). | SilentRansomGroup | 2026-09-17 | Not Found | ransomwarelive |
| harputyapi.com harputyapi.com Harput Yapı is an Istanbul-based residential real estate developer and construction company operating under the legal n... | krybit | 2026-09-17 | TR, Not Found | 2 sources |
| diakonie-apolda.de diakonie-apolda.de Diakoniewerk Apolda gGmbH is a German non-profit social welfare organization (gemeinnützige GmbH) founded in 2006, head... | krybit | 2026-09-17 | DE, Healthcare | 2 sources |
| Vigatec vigatec.com N/A | qilin | 2026-09-17 | DE, Technology | 2 sources |
| Invincible GG invinciblegg.com N/A | qilin | 2026-09-17 | Technology | 2 sources |
| W... B... To be announced... | leakeddata | 2026-09-17 | — | ransomlook |
| expresspros.com expresspros.com Express Employment Professionals — Data Breach Notification & Public Disclosure We have officially initiated the public release phase regarding expresspros.com. Despite our direct attempts to establish communication, company leadership and their representative... | chaos | 2026-09-17 | US, Professional Services | 2 sources |
| hoyletanner.com hoyletanner.com We have 33,500 (33.5k) files, the contents of which include: Contracts and agreements; Commercial proposals; Invoices; Customer database; HR ; W-9 tax forms; ACH/banking documents;... | BrainCipher | 2026-09-17 | GB, Professional Services | 2 sources |
| aecom.com aecom.com We've obtained 670 GB of data that most likely belongs to a Fortune 500 company. Stay tuned for more details — it's going to be interesting. If you think you are here by mistake,... | BrainCipher | 2026-09-17 | US, Professional Services | 2 sources |
| Techwise techwise.com.ar N/A | qilin | 2026-09-17 | Argentina, Technology | 3 sources |
| The Gran Hotel Ingles granhotelingles.com N/A | qilin | 2026-09-17 | ES, Hospitality | 2 sources |
| xpera.ca xpera.ca We have 20 GB of data belonging to this company. The data contains information such as employees' SINs, bank account details, salaries, addresses, dates of birth, RRSP/TFSA informa... | BrainCipher | 2026-09-17 | CA, Technology | 2 sources |
| Beckman Coulter, Inc beckmancoulter.com Beckman Coulter Diagnostics is a leading U.S.-based medical diagnostics company and a Danaher company. It develops and manufactures clinical laboratory instruments, diagnostic systems, and testing solutions used by hospitals, laboratories, and healthcare provi... | metaencryptor | 2026-09-17 | USA, Healthcare | 2 sources |
| AECOM aecom.com AECOM is a leading U.S.-based global infrastructure consulting and engineering company. It provides design, engineering, construction management, and advisory services for major infrastructure projects across transportation, water, energy, buildings, environme... | metaencryptor | 2026-09-17 | USA, Professional Services | 2 sources |
| Promantra, Inc promantra.us ProMantra is a U.S.-based healthcare technology and business process services company specializing in Revenue Cycle Management (RCM), medical billing, healthcare data processing, and automation. Founded in 2003, the company provides technology-enabled services... | metaencryptor | 2026-09-17 | USA, Technology | 2 sources |
Counts are listings carried by our sources within the retention window, not a measure of how active a group truly is.
Tell us what to watch for and we will email you when a group claims it. Weekly at most, only when something matches, and never the same claim twice. Double opt-in, one-click unsubscribe, and your watch list is deleted the moment you leave.
Set up an alertSources: RansomLook (CC BY 4.0, synced 2026-09-19 08:20 UTC), Ransomfeed (CC BY 4.0, synced 2026-09-19 08:20 UTC) and ransomware.live (PRO licence, synced 2026-09-19 08:20 UTC), each used under the licence shown and refreshed a few times a day. They crawl the groups' Tor leak sites; we never do, and we store no .onion address, magnet link or leak-site screenshot. Listings are the claims of criminals and are the sole responsibility of their authors; nothing here is verified, and nothing here is advice. This site stores no personal data about what you look up.