d4 · tools · leaks

Ransomware leak tracker.

Who ransomware groups are claiming to have breached, from two independent trackers of their leak sites. Unverified criminal claims, not confirmed breaches: an early signal to go and check, never a finding. Get alerts when something on your watch list is claimed. We do not record what you look up.

Tracking 2,073 claims across 108 groups, 237 of them in the last seven days.

Read this before you act on anything here

A listing means a criminal group has said it holds data from an organisation. It does not mean a breach happened, that the data is real, or that it is recent.

Groups fabricate. In April 2026 the group 0APT listed rival gangs as victims; the claims were invented. Removing them turned a reported 15% quarterly rise in attacks into a 6% fall.
Groups recycle. CISA has documented actors buying previously stolen data to re-extort. One study found 98 listings covering only 49 distinct victims.
Attribution is often wrong. Suppliers get listed as their customers, and shared domains get listed as the wrong organisation entirely.
It undercounts. The NCSC notes victims who pay never appear on a leak site at all.

Where two independent trackers carried the same claim we mark it 2 sources. That means two crawlers saw the same post, not that anyone verified it.

We publish the claim only. We do not link to leak sites, mirror screenshots, or carry any pointer to stolen data. If you are listed here and believe it is wrong, or you want the entry removed, tell us and we will act on it.

None of this is our research. The crawling is done by RansomLook, Ransomfeed and ransomware.live, and we are grateful for it. Please go to them for the full picture.

Claims by Vexy Ransomware

Organisation named	Group claiming	Claimed	Where	Sources
Quy Nhon University qnu.edu.vn Quy Nhon University (QNU) is a public, multidisciplinary university located in Quy Nhon City, Binh Dinh Province, Vietnam. Established in 1977, the university has a long-standing tradition in teacher education and has developed into a comprehensive institution...	Vexy Ransomware	2026-09-18	VN, Education	ransomwarelive
STP Fashion Lab stpfashionlab.it stpfashionlab.it is the website of STP Fashion Lab, a Tuscan company that has specialized in making Made in Italy womenswear for over twenty years. It produces the FRIVOLITÉ brand, founded in 2019, which targets independent, sensitive, and playful women.	Vexy Ransomware	2026-09-17	Italy, Retail & E-Commerce	2 sources
Hashimoto Jimuki aoa21.com Japanese company providing office equipment, IT equipment and services, office furniture, meeting/conferencing systems, and computer support.	Vexy Ransomware	2026-09-15	JP, Manufacturing	2 sources
Strad Solutions stradsolutions.com Strad Solutions provides cloud hosting, dedicated servers, managed IT, cybersecurity, and disaster recovery services for businesses worldwide.	Vexy Ransomware	2026-09-12	India, Technology	2 sources
i2k2 Networks i2k2.com i2k2 Networks Pvt. Ltd., established in 1999, is a leading Indian provider of cloud computing, web hosting, managed IT, data center, backup, disaster recovery, and DevOps solutions. With 25+ years of experience, 4,000+ customers, Tier III-compliant data center...	Vexy Ransomware	2026-09-10	India, Technology	2 sources
Logar Network Solutions logar.com.br Logar Network Solutions is a Brazilian managed IT services provider (MSP) that delivers outsourced IT management, cybersecurity, cloud infrastructure, backup and disaster recovery, software licensing, hardware lifecycle management, and custom software developm...	Vexy Ransomware	2026-09-09	Brazil, Technology	2 sources
United Group united-group.in United Group is a diversified Indian business group delivering innovative products and services across multiple industries. Founded in 2003, the company began as a food and beverage consultancy and has since expanded into food ingredients, nutraceuticals, indu...	Vexy Ransomware	2026-09-07	India, Other	2 sources
LIBRERIA SANTA FE A P S SRL lsf.com.ar LSF (Librería Santa Fe) is a bookstore based in Buenos Aires, Argentina, with multiple branches across the city (CABA). It offers a wide selection of both national and imported books across various genres and authors. The store provides an easy online shopping...	Vexy Ransomware	2026-09-07	Argentina, Retail & E-Commerce	2 sources
Sancity sancity.in An active, unlisted public company incorporated in 2012, operating in real estate/construction and real-estate marketing & sales	Vexy Ransomware	2026-09-06	India, Other	2 sources
Mega Velocity megavelocity.net New Delhi–based private technology company incorporated in 2013. Its registered business classification is software publishing, consultancy and supply, including software development, maintenance and web-page design. Its network records also identify MEGA VELO...	Vexy Ransomware	2026-09-05	MX, Transportation	2 sources
Palsana Enviro (PEPL) palsanaenviro.com Environmental services company operating a Common Effluent Treatment Plant (CETP) for textile-processing industries. PEPL collects, treats and disposes of industrial wastewater and also recycles treated water for member industries. Its current stated treatment...	Vexy Ransomware	2026-09-04	India, Utility	2 sources
Annapurna Fashion annapurnafashion.com Manufacturer, supplier and exporter/distributor of fabrics and apparel-related products, including cotton fabrics, shirting, suiting, jacquard, sherwani fabrics, uniforms, ladies' tops and readymade garments	Vexy Ransomware	2026-09-04	India, Retail & E-Commerce	2 sources
Sancity Soft Touch softtouch4u.com IT services company providing web design & development, software/application development, payment gateway services, digital marketing, mobile applications, software testing and cloud-related services.	Vexy Ransomware	2026-09-04	US, Technology	2 sources
McDonalds Ecuador mcdonalds.com.ec McDonalds Ecuador is the local franchise operation of the global McDonalds brand. The company operates fast-food restaurants across Ecuador, offering products such as burgers, fries, beverages, breakfast items, and childrens meals. It operates under the McDona...	Vexy Ransomware	2026-09-03	Ecuador, Hospitality	2 sources
Engefitas engefitas.com.br Engefitas is a Brazilian company that produces various adhesive tapes and adhesives for industries like packaging, automotive, construction, electronic, and manufacturing sectors.	Vexy Ransomware	2026-09-02	Brazil, Manufacturing	2 sources

Watch for your own name

Tell us what to watch for and we will email you when a group claims it. Weekly at most, only when something matches, and never the same claim twice. Double opt-in, one-click unsubscribe, and your watch list is deleted the moment you leave.

Set up an alert

Sources: RansomLook (CC BY 4.0, synced 2026-09-19 08:20 UTC), Ransomfeed (CC BY 4.0, synced 2026-09-19 08:20 UTC) and ransomware.live (PRO licence, synced 2026-09-19 08:20 UTC), each used under the licence shown and refreshed a few times a day. They crawl the groups' Tor leak sites; we never do, and we store no .onion address, magnet link or leak-site screenshot. Listings are the claims of criminals and are the sole responsibility of their authors; nothing here is verified, and nothing here is advice. This site stores no personal data about what you look up.