ToolsCVE trackerATT&CKLeak trackerCIDRDNSEmail securityHeadersTrackersTLSMy connectionCSP builderEmail headersJWTCert decoderPassphrasePassword checkHash & encodesecurity.txtDNSSEC & CAA

d4 · tools · leaks

Ransomware leak tracker.

Who ransomware groups are claiming to have breached, from two independent trackers of their leak sites. Unverified criminal claims, not confirmed breaches: an early signal to go and check, never a finding. Get alerts when something on your watch list is claimed. We do not record what you look up.

Tracking 2,073 claims across 108 groups, 237 of them in the last seven days.

Read this before you act on anything here

A listing means a criminal group has said it holds data from an organisation. It does not mean a breach happened, that the data is real, or that it is recent.

Where two independent trackers carried the same claim we mark it 2 sources. That means two crawlers saw the same post, not that anyone verified it.

We publish the claim only. We do not link to leak sites, mirror screenshots, or carry any pointer to stolen data. If you are listed here and believe it is wrong, or you want the entry removed, tell us and we will act on it.

None of this is our research. The crawling is done by RansomLook, Ransomfeed and ransomware.live, and we are grateful for it. Please go to them for the full picture.

Claims by audit team

Organisation namedGroup claimingClaimedWhereSources
Paid Victim 192EB2B6AD7B98D9
[AI generated] N/A I don't have any reliable information about a company named "Paid Victim 192EB2B6AD7B98D9." This appears to be an anonymized or coded identifier, possibly from a ransomware leak site or threat intelligence feed, rather than an actual company...		AuditTeam2026-09-18RU, Not Foundransomwarelive
AUDIT ENTITY: kit-e.jp
AUDIT ID: 9CB29482AF73366B / DISCOVERY DATE: 2026-09-09		audit team2026-09-18—ransomlook
AUDIT ENTITY: palletshop
AUDIT ID: 13FE12E3FD98828D / DISCOVERY DATE: 2026-09-08		audit team2026-09-16—ransomlook
AUDIT ENTITY: buben
AUDIT ID: 3A8CF838E9FD17A1 / DISCOVERY DATE: 2026-09-08		audit team2026-09-16—ransomlook
AUDIT ENTITY: Wise IT
AUDIT ID: 2567E8139A6D7753 / DISCOVERY DATE: 2026-09-08		audit team2026-09-16—ransomlook
AUDIT ENTITY: dg.ac.kr
AUDIT ID: 4FEC5C192A8A6AC3 / DISCOVERY DATE: 2026-09-08		audit team2026-09-16—ransomlook
AUDIT ENTITY: gownet.net
AUDIT ID: D4AF665C36E15B6C / DISCOVERY DATE: 2026-09-08		audit team2026-09-16—ransomlook
AUDIT ENTITY: krimax.org
AUDIT ID: FFFEE8E6DD3445AD / DISCOVERY DATE: 2026-09-08		audit team2026-09-16—ransomlook
AUDIT ENTITY: Ne***ox
AUDIT ID: 42FFBFBFF9241F2E / DISCOVERY DATE: 2026-09-14		audit team2026-09-14—ransomlook
Ne***oxAuditTeam2026-09-14RU, Technology2 sources
Paid Victim F9CF4B639CAC1B18
[AI generated] N/A		AuditTeam2026-09-13RU, Not Foundransomwarelive
Paid Victim FDC699DE3A112669
[AI generated] N/A		AuditTeam2026-09-13DE, Not Foundransomwarelive
AUDIT ENTITY: vi***in
AUDIT ID: 5DC9129A6EA7F384 / DISCOVERY DATE: 2026-09-13		audit team2026-09-13—ransomlook
vi***inAuditTeam2026-09-13Non Disponibile, Transportation2 sources
AUDIT ENTITY: TE***PB
AUDIT ID: 993E2D59C377AFDE / DISCOVERY DATE: 2026-09-12		audit team2026-09-12—ransomlook
TE***PBAuditTeam2026-09-12RU, Not Found2 sources
AUDIT ENTITY: ki***jp
AUDIT ID: 9CB29482AF73366B / DISCOVERY DATE: 2026-09-09		audit team2026-09-10—ransomlook
AUDIT ENTITY: my***ru
AUDIT ID: D91BED92A5A9223F / DISCOVERY DATE: 2026-09-09		audit team2026-09-10—ransomlook
AUDIT ENTITY: mo***al
AUDIT ID: 2431ED9F65ADD5B1 / DISCOVERY DATE: 2026-09-10		audit team2026-09-09—ransomlook
mo***alAuditTeam2026-09-09Non Disponibile, Not Found2 sources
AUDIT ENTITY: dg***kr
AUDIT ID: 4FEC5C192A8A6AC3 / DISCOVERY DATE: 2026-09-08		audit team2026-09-09—ransomlook
AUDIT ENTITY: go***et
AUDIT ID: D4AF665C36E15B6C / DISCOVERY DATE: 2026-09-08		audit team2026-09-09—ransomlook
AUDIT ENTITY: kr***rg
AUDIT ID: FFFEE8E6DD3445AD / DISCOVERY DATE: 2026-09-08		audit team2026-09-09—ransomlook
ki***jpAuditTeam2026-09-09JP, Not Found2 sources
kit-e.jp
kit-e.jp
No data breaches		AuditTeam2026-09-09JP, Technologyransomwarelive
my***ruAuditTeam2026-09-09Russia, Technology2 sources
AUDIT ENTITY: bu***en
AUDIT ID: 3A8CF838E9FD17A1 / DISCOVERY DATE: 2026-09-08		audit team2026-09-08—ransomlook
AUDIT ENTITY: Wi***IT
AUDIT ID: 2567E8139A6D7753 / DISCOVERY DATE: 2026-09-08		audit team2026-09-08—ransomlook
AUDIT ENTITY: pa***op
AUDIT ID: 13FE12E3FD98828D / DISCOVERY DATE: 2026-09-08		audit team2026-09-08—ransomlook
buben
buben.it
buben.it		AuditTeam2026-09-08IT, Otherransomwarelive
bu***enAuditTeam2026-09-08RU, Unknown2 sources
dg.ac.kr
dg.ac.kr
No data breaches		AuditTeam2026-09-08South Korea, Education2 sources
dg***krAuditTeam2026-09-08Non Disponibile, Not Found2 sources
go***etAuditTeam2026-09-08Non Disponibile, Technology2 sources
gownet.net
gownet.net
No data breaches		AuditTeam2026-09-08South Korea, Other2 sources
krimax.org
krimax.org
No data breaches		AuditTeam2026-09-08Argentina, Other2 sources
kr***rgAuditTeam2026-09-08Non Disponibile, Not Found2 sources
palletshop
palletshop.ru
palletshop.ru		AuditTeam2026-09-08Russia, Retail & E-Commerce2 sources
pa***opAuditTeam2026-09-08RU, Not Found2 sources
Wi***ITAuditTeam2026-09-08UA, Technology2 sources
Wise IT
wiseit.com.ua
Wise IT (wiseit.com.ua) is a Kyiv-based Ukrainian system integrator that provides data center, networking, virtualization, cloud migration, cybersecurity, software licensing, and IT outsourcing services, partnering with vendors such as Google, Microsoft, VMwar...		AuditTeam2026-09-08Ukraine, Technology2 sources
AUDIT ENTITY: mansurovogroup
AUDIT ID: DA68891EA2CD44B6 / DISCOVERY DATE: 2026-08-26		audit team2026-09-04—ransomlook
AUDIT ENTITY: PIT.local
AUDIT ID: 3382542458FC4332 / DISCOVERY DATE: 2026-08-27		audit team2026-09-04—ransomlook
AUDIT ENTITY: PI***al
AUDIT ID: 3382542458FC4332 / DISCOVERY DATE: 2026-08-27		audit team2026-08-27—ransomlook
PI***alAuditTeam2026-08-27Non Disponibile, Financial Services2 sources
PIT.local
pit.local
unknown		AuditTeam2026-08-27Non Disponibile, Not Found2 sources
AUDIT ENTITY: Demidov Steel Group
AUDIT ID: 22C42D81C3DA7328 / DISCOVERY DATE: 2026-08-18		audit team2026-08-26—ransomlook
mansurovogroup
mansurovteam.com
mansurovogroup is an integrated agricultural enterprise based in Kursk Oblast, Russia. It operates across four main segments: grain cultivation and seed production, cattle farming (beef and dairy), sheep farming (wool and meat), and horse breeding at a stud fa...		AuditTeam2026-08-26Russia, Other2 sources
AUDIT ENTITY: ma***up
AUDIT ID: DA68891EA2CD44B6 / DISCOVERY DATE: 2026-08-26		audit team2026-08-25—ransomlook
ma***upAuditTeam2026-08-25RU, Not Foundransomwarelive
AUDIT ENTITY: De***up
AUDIT ID: 22C42D81C3DA7328 / DISCOVERY DATE: 2026-08-18		audit team2026-08-18—ransomlook
Demidov Steel Group
demidovsteel.ru
Demidov Steel Group (ГК Демидов) is a Russian metal products manufacturer and trader, website: demidovsteel.ru. The company owns its own plants (Ryazan, Davlekanovo, Novocherkassk, and others), sells wholesale and retail, and supplies 4,000+ products including...		AuditTeam2026-08-18Russia, Manufacturing2 sources
De***upAuditTeam2026-08-18RU, Unknown2 sources

Watch for your own name

Tell us what to watch for and we will email you when a group claims it. Weekly at most, only when something matches, and never the same claim twice. Double opt-in, one-click unsubscribe, and your watch list is deleted the moment you leave.

Set up an alert

Sources: RansomLook (CC BY 4.0, synced 2026-09-19 08:20 UTC), Ransomfeed (CC BY 4.0, synced 2026-09-19 08:20 UTC) and ransomware.live (PRO licence, synced 2026-09-19 08:20 UTC), each used under the licence shown and refreshed a few times a day. They crawl the groups' Tor leak sites; we never do, and we store no .onion address, magnet link or leak-site screenshot. Listings are the claims of criminals and are the sole responsibility of their authors; nothing here is verified, and nothing here is advice. This site stores no personal data about what you look up.