d4 · tools · leaks
Who ransomware groups are claiming to have breached, from two independent trackers of their leak sites. Unverified criminal claims, not confirmed breaches: an early signal to go and check, never a finding. Get alerts when something on your watch list is claimed. We do not record what you look up.
Tracking 2,073 claims across 108 groups, 237 of them in the last seven days.
A listing means a criminal group has said it holds data from an organisation. It does not mean a breach happened, that the data is real, or that it is recent.
Where two independent trackers carried the same claim we mark it 2 sources. That means two crawlers saw the same post, not that anyone verified it.
We publish the claim only. We do not link to leak sites, mirror screenshots, or carry any pointer to stolen data. If you are listed here and believe it is wrong, or you want the entry removed, tell us and we will act on it.
None of this is our research. The crawling is done by RansomLook, Ransomfeed and ransomware.live, and we are grateful for it. Please go to them for the full picture.
| Organisation named | Group claiming | Claimed | Where | Sources |
|---|---|---|---|---|
| Inter (Venezuela's largest internet provider) Telecommunications / ISP · Venezuela | Subscriber connection records: 15,300,000+ entries, tens of thousands of subscriber addresses with the services they contacted; Complete internal network map across all regional operations; Core infrastructure configurati... | N0n | 2026-09-18 | VE, Technology | ransomwarelive |
| United Federation of Teachers uft.org Education / Labor Union · US — New York What will be published if no settlement is reached The union’s complete legal case archive — approx. 181,420 documents: grievance and arbitration files, disciplinary appeal decisions and personnel case files, each named... | N0n | 2026-09-18 | US, Education | 2 sources |
| Vietnamese betting operator (GC789 network / Boundless TE) Online gambling / agent platform · Vietnam / Switzerland What will be published if no settlement is reached The complete bettor database: 2,021,011 registered bettors with names, +84 phone numbers, email addresses, deposit and withdrawal amounts The full agent... | N0n | 2026-09-18 | VN, Other | 2 sources |
| BeLi Teacher / FSC education centers (AWS) beliteachers.com Education / edtech · Vietnam What will be published if no settlement is reached The complete CRM lead database: 152,044 contact records — names, emails, +84 phone numbers, cities, study interests, engagement history The CRM file archive (tasks, forums, comment... | N0n | 2026-09-18 | VN, Education | 2 sources |
| Konnatus (usucapião legal services) Legal services / real estate · Brazil What will be published if no settlement is reached The application database: chart of accounts, income/outflow structures, account types User accounts with password hashes Publication proceeds after the deadline. | N0n | 2026-09-18 | BR, Professional Services | 2 sources |
| STOKR (digital securities platform) stokr.io Digital securities / investment platform · Luxembourg - EU What will be published if no settlement is reached KYC investor register: full names, emails, countries, nationalities, wallet addresses and tax IDs where present Identity-to-crypto-wallet mapping of K... | N0n | 2026-09-18 | LU, Financial Services | 2 sources |
| AstraZeneca Türkiye astrazeneca.com.tr Pharmaceutical manufacturing (GxP) · Türkiye What will be published if no settlement is reached Complete internal network-security configuration of all 3 sites (940 MB): every rule, device definition, remote-access mappings 1.35M connection records: M365/Intun... | N0n | 2026-09-18 | TR, Healthcare | 2 sources |
| Argentem Creek Partners (investment firm) argentemcreek.com Investment management / private credit · United States What will be published if no settlement is reached Full corporate network evidence: 2.5M+ connection records, complete internal systems map (Active Directory, SharePoint, MSP tooling, office-security integ... | N0n | 2026-09-18 | US, Financial Services | 2 sources |
| Ministry of Education — Argentina argentina.gob.ar Government / education · Argentina What will be published if no settlement is reached Complete network-security configuration of the ministry network 1.08M connection records: national library (BNM), school-book selection platform, scholarship systems (becaspr... | N0n | 2026-09-18 | AR, Government & Defense | 2 sources |
| PayPal support operations (Transcom WorldWide) transcom.com Outsourced customer support / financial services · Netherlands / Tunisia What will be published if no settlement is reached 86.7M connection records: daily support-agent sessions into PayPal corporate Citrix/AAA systems Complete infrastructure map: internal AD... | N0n | 2026-09-18 | SE, Financial Services | 2 sources |
Tell us what to watch for and we will email you when a group claims it. Weekly at most, only when something matches, and never the same claim twice. Double opt-in, one-click unsubscribe, and your watch list is deleted the moment you leave.
Set up an alertSources: RansomLook (CC BY 4.0, synced 2026-09-19 08:20 UTC), Ransomfeed (CC BY 4.0, synced 2026-09-19 08:20 UTC) and ransomware.live (PRO licence, synced 2026-09-19 08:20 UTC), each used under the licence shown and refreshed a few times a day. They crawl the groups' Tor leak sites; we never do, and we store no .onion address, magnet link or leak-site screenshot. Listings are the claims of criminals and are the sole responsibility of their authors; nothing here is verified, and nothing here is advice. This site stores no personal data about what you look up.