d4 · tools · leaks

Ransomware leak tracker.

Who ransomware groups are claiming to have breached, from two independent trackers of their leak sites. Unverified criminal claims, not confirmed breaches: an early signal to go and check, never a finding. Get alerts when something on your watch list is claimed. We do not record what you look up.

Tracking 183 claims across 32 groups, 171 of them in the last seven days.

Read this before you act on anything here

A listing means a criminal group has said it holds data from an organisation. It does not mean a breach happened, that the data is real, or that it is recent.

Groups fabricate. In April 2026 the group 0APT listed rival gangs as victims; the claims were invented. Removing them turned a reported 15% quarterly rise in attacks into a 6% fall.
Groups recycle. CISA has documented actors buying previously stolen data to re-extort. One study found 98 listings covering only 49 distinct victims.
Attribution is often wrong. Suppliers get listed as their customers, and shared domains get listed as the wrong organisation entirely.
It undercounts. The NCSC notes victims who pay never appear on a leak site at all.

Where two independent trackers carried the same claim we mark it 2 sources. That means two crawlers saw the same post, not that anyone verified it.

We publish the claim only. We do not link to leak sites, mirror screenshots, or carry any pointer to stolen data. If you are listed here and believe it is wrong, or you want the entry removed, tell us and we will act on it.

None of this is our research. The crawling is done by RansomLook, Ransomfeed and ransomware.live, and we are grateful for it. Please go to them for the full picture.

Claims by incransom

Organisation named	Group claiming	Claimed	Where	Sources
lantisnet.com lantisnet.com Lantis Enterprises, Inc. is an American consulting and management organization historically rooted in rural healthcare, skilled nursing, and senior living operations. Headquartered in Spearfish, South Dakota, the firm has expanded its focus to cross-industry a...	incransom	2026-08-04	US, Technology	2 sources
Loyalist College The management of this institution was repeatedly warned about the disclosure of hundreds of personal data. Each of you who is faced with the consequences of the leak can be absolutely sure that the management of Loyalist College absolutely does not care about...	incransom	2026-08-04	CA, Education	2 sources
geleximco.vn geleximco.vn 200gb data	incransom	2026-08-04	VN, Manufacturing	2 sources
lccgroup.com lccgroup.com LCC - Liberty Commercial Center, Inc is one of the pioneering retail establishments in the Bicol Region. Based in the dynamic province of Albay, LCC primarily operates supermarkets, department stores, malls, and food establishments. LCC is also engaged in prop...	incransom	2026-08-04	PH, Professional Services	2 sources
pushidrosal.id pushidrosal.id *	incransom	2026-08-04	ID, Other	2 sources
TRULITE GLASS & ALUMINUM SOLUTIONS TRULITE GLASS & ALUMINUM SOLUTIONS Date: August 2026 Overview Trulite Glass & Aluminum Solutions, a portfolio company of Truelink Capital (Los Angeles, CA), is a leading North American fabricator and distributor of architectural glass and aluminum systems. Hea...	incransom	2026-08-04	US, Manufacturing	2 sources
Oleoductos del Valle oldelval.com During the analysis of data obtained from Oldelval, we have compiled information covering key aspects of the company's operations. The materials include: 1.HR documentation: full payroll data, bank account details (CBU), employee health insurance records (OSDE...	incransom	2026-08-03	AR, Energy & Utilities	ransomwarelive
clintonhealthaccess.org clintonhealthaccess.org This Clinton foundation sponsors the sterilization of women in Africa and South America. With the help of this foundation, organs harvested criminally by transplant surgeons from people in Third World countries are legalized to improve the quality of life of t...	incransom	2026-08-03	US, Healthcare	2 sources
ecfa.org ecfa.org The Evangelical Council for Financial Accountability (ECFA) is an American accreditation agency founded in 1979 that certifies Christian churches and nonprofits based on financial integrity, board governance, and transparent fundraising. It represents over 2,7...	incransom	2026-08-02	USA, Professional Services	3 sources
quantinuum.com quantinuum.com Quantinuum is a quantum computing company that develops advanced quantum computers, software, and cybersecurity solutions to solve complex scientific and industrial challenges. The company provides full-stack quantum technologies for areas such as materials sc...	incransom	2026-08-01	USA, Technology	3 sources

Watch for your own name

Tell us what to watch for and we will email you when a group claims it. Weekly at most, only when something matches, and never the same claim twice. Double opt-in, one-click unsubscribe, and your watch list is deleted the moment you leave.

Set up an alert

Sources: RansomLook (CC BY 4.0, synced 2026-08-05 09:15 UTC), Ransomfeed (CC BY 4.0, synced 2026-08-05 09:15 UTC) and ransomware.live (PRO licence, synced 2026-08-05 09:15 UTC), each used under the licence shown and refreshed a few times a day. They crawl the groups' Tor leak sites; we never do, and we store no .onion address, magnet link or leak-site screenshot. Listings are the claims of criminals and are the sole responsibility of their authors; nothing here is verified, and nothing here is advice. This site stores no personal data about what you look up.