d4 · tools · leaks

Ransomware leak tracker.

Who ransomware groups are claiming to have breached, from two independent trackers of their leak sites. Unverified criminal claims, not confirmed breaches: an early signal to go and check, never a finding. Get alerts when something on your watch list is claimed. We do not record what you look up.

Tracking 2,073 claims across 108 groups, 237 of them in the last seven days.

Read this before you act on anything here

A listing means a criminal group has said it holds data from an organisation. It does not mean a breach happened, that the data is real, or that it is recent.

Groups fabricate. In April 2026 the group 0APT listed rival gangs as victims; the claims were invented. Removing them turned a reported 15% quarterly rise in attacks into a 6% fall.
Groups recycle. CISA has documented actors buying previously stolen data to re-extort. One study found 98 listings covering only 49 distinct victims.
Attribution is often wrong. Suppliers get listed as their customers, and shared domains get listed as the wrong organisation entirely.
It undercounts. The NCSC notes victims who pay never appear on a leak site at all.

Where two independent trackers carried the same claim we mark it 2 sources. That means two crawlers saw the same post, not that anyone verified it.

We publish the claim only. We do not link to leak sites, mirror screenshots, or carry any pointer to stolen data. If you are listed here and believe it is wrong, or you want the entry removed, tell us and we will act on it.

None of this is our research. The crawling is done by RansomLook, Ransomfeed and ransomware.live, and we are grateful for it. Please go to them for the full picture.

Claims by rhysida

Organisation named	Group claiming	Claimed	Where	Sources
MPA Pharma mpapharma.de MPA Pharma MPA Pharma GmbH is an internationally active, rapidly growing company specializing in the import and trade of high-quality pharmaceuticals, including both patented and generic products. 2,899,290 files, ~5.8 TBPharmaceutical companyCategories: accou...	rhysida	2026-09-18	DE, Healthcare	2 sources
Axdia International axdia.com Axdia International Axdia International is a German electronics company that brings together a wide range of modern small electronics and electric mobility products. More	rhysida	2026-09-12	Germany, Professional Services	3 sources
General Santos Doctors Hospital gsdh.com.ph General Santos Doctors Hospital 3.502.636 files, total volume ~2.44 TBPatient data (PHI) � name-tagged scans across department shares (surgical pathology, hemodialysis charts, admission records), cancer-center dossiers with PhilHealth IDs, lab quotations incl....	rhysida	2026-09-10	Philippines, Healthcare	3 sources
Professional Retail Services profretail.com Professional Retail Services Owner�s documents: employee evaluations, salary rates, bonuses, job offers, family documentsCFO�s documents: client credit reports, bankruptcy records, tax documents, father�s medical records (guardianship court case)Corporate fina...	rhysida	2026-09-10	USA, Retail & E-Commerce	3 sources
SAD'S Interim sads-interim.eu SAD'S Interim Since 2000, SAD'S INTERIM has established itself as a key player in the temporary employment sector.Bank statements (relev�s) with SEPA credit transfersFactoring: invoice import batches, client receivables ledgers (encours) with EUR amounts and n...	rhysida	2026-09-08	France, Professional Services	3 sources
Rug & Home rugandhome.com Rug & Home Rug & Home is a leading destination in the USA for rugs, furniture, and home decor, offering a vast selection of unique designs and top brands.Database of 50,193 customers�full names, home addresses, email addresses, phone numbers, purchase amounts...	rhysida	2026-09-07	USA, Retail & E-Commerce	3 sources
Szechenyi Programiroda Nonprofit Kf szpi.hu Szechenyi Programiroda Nonprofit Kf As a key player in Hungarian development policy, our Company participates in the planning and implementation of development programs based on certain EU and domestic funds. More	rhysida	2026-09-01	Hungary, Other	3 sources
Berlin, Germany Berlin, Germany Total capacity 5.79 TBArchive scale: ~1.44 million files scanned; by category � Maps/Geo 124,823, Legal/complaints 77,939, Financial 55,553, Contracts 46,522, HR 27,299,Government supervisory 13,142, Confidential 11,777, Infrastructure 8,110, P...	rhysida	2026-08-28	DE, Not Found	2 sources
Valley Health Team vht.org Valley Health Team 9,056,196 files3.28 TBLarge SQL databases containing the clinic's entire lifetime of information.Major databases:160,870 patients4.18 million diagnoses7.6 million unencrypted EHR scansSSN, passports, and other personal data.Financial stateme...	rhysida	2026-08-28	USA, Healthcare services	3 sources
CRI Electric crielectric.com CRI Electric CRI Electric is a veteran-owned business based in San Antonio, providing professional electrical services since 1998. They cater to both residential and commercial clients, offering services such as emergency electrical repairs, EV charger install...	rhysida	2026-08-22	USA, Energy & Utilities	3 sources
Coming soon Coming soon Total capacity 5.79 TBLegal/Complaints/Offenses 77,939 OWi proceedings, lawsuits, legal opinionsFinance 55,553 Budget, invoices, ProFISKAL, debt collectionContracts 46,522 Contracts, NDAs, procurementHR/Personnel 27,299 Personnel files, payroll, pe...	rhysida	2026-08-21	—	ransomlook
Fairview Dental Group fairviewdental.ca Fairview Dental Group Fairview Dental Group offers a range of dental services including family dentistry, cosmetic treatments, dental implants, and invisible braces.We are pleased to present:Full patient database, patient X-rays, scanned forms/consents/invoice...	rhysida	2026-08-21	US, Healthcare	3 sources
Battle Creek Public Schools battlecreekschools.net Battle Creek Public Schools Battle Creek Public Schools in Nebraska provides educational services for students from pre-kindergarten through 12th grade. We are pleased to present:Student records of named minors:** IEP/special-ed files, disability determination...	rhysida	2026-08-21	USA, Education	3 sources
Pierce Township piercetownship.org Pierce Township Pierce Township is a growing community in Ohio that blends rural charm with suburban living, covering 23.5 square miles and home to over 16,000 residents.We are pleased to present:Judicial materials - Grand Jury subpoena response incl. hospital...	rhysida	2026-08-14	USA, Local administrations	3 sources
SIA Medical Centre siamed.com.au SIA Medical Centre SIA Medical was established in 1993 and was founded by Dr Martin Sia in Melbourne's northwest. 9 clinics - Box Hill, Burwood, Croydon, Essendon, Footscray, Moonee Ponds, Montrose, Mulgrave and Berwick.We are pleased to present:~20,000 patien...	rhysida	2026-08-13	Australia, Healthcare services	3 sources

Watch for your own name

Tell us what to watch for and we will email you when a group claims it. Weekly at most, only when something matches, and never the same claim twice. Double opt-in, one-click unsubscribe, and your watch list is deleted the moment you leave.

Set up an alert

Sources: RansomLook (CC BY 4.0, synced 2026-09-19 08:20 UTC), Ransomfeed (CC BY 4.0, synced 2026-09-19 08:20 UTC) and ransomware.live (PRO licence, synced 2026-09-19 08:20 UTC), each used under the licence shown and refreshed a few times a day. They crawl the groups' Tor leak sites; we never do, and we store no .onion address, magnet link or leak-site screenshot. Listings are the claims of criminals and are the sole responsibility of their authors; nothing here is verified, and nothing here is advice. This site stores no personal data about what you look up.