d4 · tools · leaks
Who ransomware groups are claiming to have breached, from two independent trackers of their leak sites. Unverified criminal claims, not confirmed breaches: an early signal to go and check, never a finding. Get alerts when something on your watch list is claimed. We do not record what you look up.
Tracking 2,073 claims across 108 groups, 237 of them in the last seven days.
A listing means a criminal group has said it holds data from an organisation. It does not mean a breach happened, that the data is real, or that it is recent.
Where two independent trackers carried the same claim we mark it 2 sources. That means two crawlers saw the same post, not that anyone verified it.
We publish the claim only. We do not link to leak sites, mirror screenshots, or carry any pointer to stolen data. If you are listed here and believe it is wrong, or you want the entry removed, tell us and we will act on it.
None of this is our research. The crawling is done by RansomLook, Ransomfeed and ransomware.live, and we are grateful for it. Please go to them for the full picture.
| Organisation named | Group claiming | Claimed | Where | Sources |
|---|---|---|---|---|
| Paid Victim 192EB2B6AD7B98D9 [AI generated] N/A I don't have any reliable information about a company named "Paid Victim 192EB2B6AD7B98D9." This appears to be an anonymized or coded identifier, possibly from a ransomware leak site or threat intelligence feed, rather than an actual company... | AuditTeam | 2026-09-18 | RU, Not Found | ransomwarelive |
| AUDIT ENTITY: kit-e.jp AUDIT ID: 9CB29482AF73366B / DISCOVERY DATE: 2026-09-09 | audit team | 2026-09-18 | — | ransomlook |
| AUDIT ENTITY: palletshop AUDIT ID: 13FE12E3FD98828D / DISCOVERY DATE: 2026-09-08 | audit team | 2026-09-16 | — | ransomlook |
| AUDIT ENTITY: buben AUDIT ID: 3A8CF838E9FD17A1 / DISCOVERY DATE: 2026-09-08 | audit team | 2026-09-16 | — | ransomlook |
| AUDIT ENTITY: Wise IT AUDIT ID: 2567E8139A6D7753 / DISCOVERY DATE: 2026-09-08 | audit team | 2026-09-16 | — | ransomlook |
| AUDIT ENTITY: dg.ac.kr AUDIT ID: 4FEC5C192A8A6AC3 / DISCOVERY DATE: 2026-09-08 | audit team | 2026-09-16 | — | ransomlook |
| AUDIT ENTITY: gownet.net AUDIT ID: D4AF665C36E15B6C / DISCOVERY DATE: 2026-09-08 | audit team | 2026-09-16 | — | ransomlook |
| AUDIT ENTITY: krimax.org AUDIT ID: FFFEE8E6DD3445AD / DISCOVERY DATE: 2026-09-08 | audit team | 2026-09-16 | — | ransomlook |
| AUDIT ENTITY: Ne***ox AUDIT ID: 42FFBFBFF9241F2E / DISCOVERY DATE: 2026-09-14 | audit team | 2026-09-14 | — | ransomlook |
| Ne***ox | AuditTeam | 2026-09-14 | RU, Technology | 2 sources |
| Paid Victim F9CF4B639CAC1B18 [AI generated] N/A | AuditTeam | 2026-09-13 | RU, Not Found | ransomwarelive |
| Paid Victim FDC699DE3A112669 [AI generated] N/A | AuditTeam | 2026-09-13 | DE, Not Found | ransomwarelive |
| AUDIT ENTITY: vi***in AUDIT ID: 5DC9129A6EA7F384 / DISCOVERY DATE: 2026-09-13 | audit team | 2026-09-13 | — | ransomlook |
| vi***in | AuditTeam | 2026-09-13 | Non Disponibile, Transportation | 2 sources |
| AUDIT ENTITY: TE***PB AUDIT ID: 993E2D59C377AFDE / DISCOVERY DATE: 2026-09-12 | audit team | 2026-09-12 | — | ransomlook |
| TE***PB | AuditTeam | 2026-09-12 | RU, Not Found | 2 sources |
| AUDIT ENTITY: ki***jp AUDIT ID: 9CB29482AF73366B / DISCOVERY DATE: 2026-09-09 | audit team | 2026-09-10 | — | ransomlook |
| AUDIT ENTITY: my***ru AUDIT ID: D91BED92A5A9223F / DISCOVERY DATE: 2026-09-09 | audit team | 2026-09-10 | — | ransomlook |
| AUDIT ENTITY: mo***al AUDIT ID: 2431ED9F65ADD5B1 / DISCOVERY DATE: 2026-09-10 | audit team | 2026-09-09 | — | ransomlook |
| mo***al | AuditTeam | 2026-09-09 | Non Disponibile, Not Found | 2 sources |
| AUDIT ENTITY: dg***kr AUDIT ID: 4FEC5C192A8A6AC3 / DISCOVERY DATE: 2026-09-08 | audit team | 2026-09-09 | — | ransomlook |
| AUDIT ENTITY: go***et AUDIT ID: D4AF665C36E15B6C / DISCOVERY DATE: 2026-09-08 | audit team | 2026-09-09 | — | ransomlook |
| AUDIT ENTITY: kr***rg AUDIT ID: FFFEE8E6DD3445AD / DISCOVERY DATE: 2026-09-08 | audit team | 2026-09-09 | — | ransomlook |
| ki***jp | AuditTeam | 2026-09-09 | JP, Not Found | 2 sources |
| kit-e.jp kit-e.jp No data breaches | AuditTeam | 2026-09-09 | JP, Technology | ransomwarelive |
| my***ru | AuditTeam | 2026-09-09 | Russia, Technology | 2 sources |
| AUDIT ENTITY: bu***en AUDIT ID: 3A8CF838E9FD17A1 / DISCOVERY DATE: 2026-09-08 | audit team | 2026-09-08 | — | ransomlook |
| AUDIT ENTITY: Wi***IT AUDIT ID: 2567E8139A6D7753 / DISCOVERY DATE: 2026-09-08 | audit team | 2026-09-08 | — | ransomlook |
| AUDIT ENTITY: pa***op AUDIT ID: 13FE12E3FD98828D / DISCOVERY DATE: 2026-09-08 | audit team | 2026-09-08 | — | ransomlook |
| buben buben.it buben.it | AuditTeam | 2026-09-08 | IT, Other | ransomwarelive |
| bu***en | AuditTeam | 2026-09-08 | RU, Unknown | 2 sources |
| dg.ac.kr dg.ac.kr No data breaches | AuditTeam | 2026-09-08 | South Korea, Education | 2 sources |
| dg***kr | AuditTeam | 2026-09-08 | Non Disponibile, Not Found | 2 sources |
| go***et | AuditTeam | 2026-09-08 | Non Disponibile, Technology | 2 sources |
| gownet.net gownet.net No data breaches | AuditTeam | 2026-09-08 | South Korea, Other | 2 sources |
| krimax.org krimax.org No data breaches | AuditTeam | 2026-09-08 | Argentina, Other | 2 sources |
| kr***rg | AuditTeam | 2026-09-08 | Non Disponibile, Not Found | 2 sources |
| palletshop palletshop.ru palletshop.ru | AuditTeam | 2026-09-08 | Russia, Retail & E-Commerce | 2 sources |
| pa***op | AuditTeam | 2026-09-08 | RU, Not Found | 2 sources |
| Wi***IT | AuditTeam | 2026-09-08 | UA, Technology | 2 sources |
| Wise IT wiseit.com.ua Wise IT (wiseit.com.ua) is a Kyiv-based Ukrainian system integrator that provides data center, networking, virtualization, cloud migration, cybersecurity, software licensing, and IT outsourcing services, partnering with vendors such as Google, Microsoft, VMwar... | AuditTeam | 2026-09-08 | Ukraine, Technology | 2 sources |
| AUDIT ENTITY: mansurovogroup AUDIT ID: DA68891EA2CD44B6 / DISCOVERY DATE: 2026-08-26 | audit team | 2026-09-04 | — | ransomlook |
| AUDIT ENTITY: PIT.local AUDIT ID: 3382542458FC4332 / DISCOVERY DATE: 2026-08-27 | audit team | 2026-09-04 | — | ransomlook |
| AUDIT ENTITY: PI***al AUDIT ID: 3382542458FC4332 / DISCOVERY DATE: 2026-08-27 | audit team | 2026-08-27 | — | ransomlook |
| PI***al | AuditTeam | 2026-08-27 | Non Disponibile, Financial Services | 2 sources |
| PIT.local pit.local unknown | AuditTeam | 2026-08-27 | Non Disponibile, Not Found | 2 sources |
| AUDIT ENTITY: Demidov Steel Group AUDIT ID: 22C42D81C3DA7328 / DISCOVERY DATE: 2026-08-18 | audit team | 2026-08-26 | — | ransomlook |
| mansurovogroup mansurovteam.com mansurovogroup is an integrated agricultural enterprise based in Kursk Oblast, Russia. It operates across four main segments: grain cultivation and seed production, cattle farming (beef and dairy), sheep farming (wool and meat), and horse breeding at a stud fa... | AuditTeam | 2026-08-26 | Russia, Other | 2 sources |
| AUDIT ENTITY: ma***up AUDIT ID: DA68891EA2CD44B6 / DISCOVERY DATE: 2026-08-26 | audit team | 2026-08-25 | — | ransomlook |
| ma***up | AuditTeam | 2026-08-25 | RU, Not Found | ransomwarelive |
| AUDIT ENTITY: De***up AUDIT ID: 22C42D81C3DA7328 / DISCOVERY DATE: 2026-08-18 | audit team | 2026-08-18 | — | ransomlook |
| Demidov Steel Group demidovsteel.ru Demidov Steel Group (ГК Демидов) is a Russian metal products manufacturer and trader, website: demidovsteel.ru. The company owns its own plants (Ryazan, Davlekanovo, Novocherkassk, and others), sells wholesale and retail, and supplies 4,000+ products including... | AuditTeam | 2026-08-18 | Russia, Manufacturing | 2 sources |
| De***up | AuditTeam | 2026-08-18 | RU, Unknown | 2 sources |
Tell us what to watch for and we will email you when a group claims it. Weekly at most, only when something matches, and never the same claim twice. Double opt-in, one-click unsubscribe, and your watch list is deleted the moment you leave.
Set up an alertSources: RansomLook (CC BY 4.0, synced 2026-09-19 08:20 UTC), Ransomfeed (CC BY 4.0, synced 2026-09-19 08:20 UTC) and ransomware.live (PRO licence, synced 2026-09-19 08:20 UTC), each used under the licence shown and refreshed a few times a day. They crawl the groups' Tor leak sites; we never do, and we store no .onion address, magnet link or leak-site screenshot. Listings are the claims of criminals and are the sole responsibility of their authors; nothing here is verified, and nothing here is advice. This site stores no personal data about what you look up.