d4 · tools · leaks

Ransomware leak tracker.

Who ransomware groups are claiming to have breached, from two independent trackers of their leak sites. Unverified criminal claims, not confirmed breaches: an early signal to go and check, never a finding. Get alerts when something on your watch list is claimed. We do not record what you look up.

Tracking 2,073 claims across 108 groups, 237 of them in the last seven days.

Read this before you act on anything here

A listing means a criminal group has said it holds data from an organisation. It does not mean a breach happened, that the data is real, or that it is recent.

Groups fabricate. In April 2026 the group 0APT listed rival gangs as victims; the claims were invented. Removing them turned a reported 15% quarterly rise in attacks into a 6% fall.
Groups recycle. CISA has documented actors buying previously stolen data to re-extort. One study found 98 listings covering only 49 distinct victims.
Attribution is often wrong. Suppliers get listed as their customers, and shared domains get listed as the wrong organisation entirely.
It undercounts. The NCSC notes victims who pay never appear on a leak site at all.

Where two independent trackers carried the same claim we mark it 2 sources. That means two crawlers saw the same post, not that anyone verified it.

We publish the claim only. We do not link to leak sites, mirror screenshots, or carry any pointer to stolen data. If you are listed here and believe it is wrong, or you want the entry removed, tell us and we will act on it.

None of this is our research. The crawling is done by RansomLook, Ransomfeed and ransomware.live, and we are grateful for it. Please go to them for the full picture.

Claims by BrainCipher

Organisation named	Group claiming	Claimed	Where	Sources
hoyletanner.com hoyletanner.com We have 33,500 (33.5k) files, the contents of which include: Contracts and agreements; Commercial proposals; Invoices; Customer database; HR ; W-9 tax forms; ACH/banking documents;...	BrainCipher	2026-09-17	GB, Professional Services	2 sources
aecom.com aecom.com We've obtained 670 GB of data that most likely belongs to a Fortune 500 company. Stay tuned for more details — it's going to be interesting. If you think you are here by mistake,...	BrainCipher	2026-09-17	US, Professional Services	2 sources
xpera.ca xpera.ca We have 20 GB of data belonging to this company. The data contains information such as employees' SINs, bank account details, salaries, addresses, dates of birth, RRSP/TFSA informa...	BrainCipher	2026-09-17	CA, Technology	2 sources
icot.es icot.es If you use this hosting service, we have some bad news for you. We'll soon be publishing more than 200 database backups that belong to you. Demo download: h4zmek6bf3lebauy7dtyxmui6...	BrainCipher	2026-08-31	Spain, Technology	3 sources
aeiconsultants.com aeiconsultants.com We have about 35,000(35k) documents and files of your company, with a total size of over 55 GB. The data includes: Personal Data, Real Estate Data, Internal Security/HR, Infrastruc...	BrainCipher	2026-08-31	USA, Professional Services	3 sources
syc.es syc.es We have about 57,000(57k) documents and files of your company, with a total size of over 40 GB. Contents: Personal data of thousands of candidates for top positions; Data on the fi...	BrainCipher	2026-08-31	Spain, Technology	3 sources
Adviesbureau De Beuckelaer BV We have about 415,000(415k) documents and files of your company, with a total size of over 150 GB. Virtually all data falls under the protected category: 1) Financial data for more...	BrainCipher	2026-08-31	NL, Professional Services	3 sources
ahadandco.com ahadandco.com We have about 405,000(405k) documents and files of your company, with a total size of over 300 GB. This data contains a significant amount of banking information, as well as the pe...	BrainCipher	2026-08-31	USA, Other	3 sources
sago.com sago.com We have approximately 56,000 (56k) documents and files belonging to your company, including data on business relationships with more than 800 clients; data on research participants...	BrainCipher	2026-08-31	USA, Technology	3 sources
crmeyer.com crmeyer.com We have about 275,000(275k) documents and files of your company, with a total size of over 330 GB. The data includes a customer database (~250 customers) — the largest ones are:...	BrainCipher	2026-08-31	USA, Professional Services	3 sources
ccsperfusion.com ccsperfusion.com We have approximately 306,000 (306k) documents and files belonging to your company, with a total size of over 200 GB. 160k files containing complete employee personnel files; 75k f...	BrainCipher	2026-08-31	USA, Healthcare	3 sources

Watch for your own name

Tell us what to watch for and we will email you when a group claims it. Weekly at most, only when something matches, and never the same claim twice. Double opt-in, one-click unsubscribe, and your watch list is deleted the moment you leave.

Set up an alert

Sources: RansomLook (CC BY 4.0, synced 2026-09-19 08:20 UTC), Ransomfeed (CC BY 4.0, synced 2026-09-19 08:20 UTC) and ransomware.live (PRO licence, synced 2026-09-19 08:20 UTC), each used under the licence shown and refreshed a few times a day. They crawl the groups' Tor leak sites; we never do, and we store no .onion address, magnet link or leak-site screenshot. Listings are the claims of criminals and are the sole responsibility of their authors; nothing here is verified, and nothing here is advice. This site stores no personal data about what you look up.