Two kinds of entries here, clearly labeled: confirmed incidents we've fact-checked and written up in depth, and a live feed of ransomware leak-site claims pulled from public tracking data — real and current, but unverified attacker claims, not confirmed breach notifications. Spot an error?Tell us. Running a healthcare organization? Check your2027 HIPAA readinessor search whether a specific organization has beenclaimed by name.
30
Confirmed, deep-dive incidents
3K+
Ransomware claims, last 2 years
365.2M+
Records/people affected (confirmed)
52
Countries in this dataset
Live claims feed last refreshed September 24, 2026· 6K+ claims tracked all-time across these sectors, source:ransomware.live
Confirmed incidents by year
190 of 190 entries
ASYAD GROUP
Oman
The ransomware group "Spirals" listed ASYAD GROUP on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
OnTrac
United States
The ransomware group "emperador" listed OnTrac on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
RECEITA FEDERAL DO BRASIL
Brazil
The ransomware group "emperador" listed RECEITA FEDERAL DO BRASIL on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Smart Eye Care
Unknown
The ransomware group "Booba Project" listed Smart Eye Care on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Washington County
United States
The ransomware group "Booba Project" listed Washington County on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Fresenius Medical Care
Germany
The ransomware group "shinyhunters" listed Fresenius Medical Care on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Grupo Hospifar S.R.L.
Argentina
The ransomware group "titan" listed Grupo Hospifar S.R.L. on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Sherman Chan, DDS, Inc.
Unknown
The ransomware group "titan" listed Sherman Chan, DDS, Inc. on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Charlottesville Police Department
United States
The ransomware group "Doommageddon" listed Charlottesville Police Department on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Hudson MD Group, LLC
United States
The ransomware group "metaencryptor" listed Hudson MD Group, LLC on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
TrueCore Behavioral Solutions
United States
The ransomware group "Storm" listed TrueCore Behavioral Solutions on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
U.S. Electrical Services and Wiedenbach Brown
Unknown
The ransomware group "moneymessage" listed U.S. Electrical Services and Wiedenbach Brown on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Alabama Woman's Health Care
United States
The ransomware group "emperador" listed Alabama Woman's Health Care on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Great Bay Bio
Hong Kong SAR China
The ransomware group "nightspire" listed Great Bay Bio on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Siddhi Green Excellence Pvt. Ltd
India
The ransomware group "Orova" listed Siddhi Green Excellence Pvt. Ltd on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Touring Club Suisse
Switzerland
The ransomware group "qilin" listed Touring Club Suisse on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Cassias MG Government
Brazil
The ransomware group "emperador" listed Cassias MG Government on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Accela.com
United States
The ransomware group "EndZone" listed Accela.com on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
AstraZeneca Türkiye
Türkiye
The ransomware group "N0n" listed AstraZeneca Türkiye on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Inland and Offshore Contractors
Trinidad & Tobago
The ransomware group "qilin" listed Inland and Offshore Contractors on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Ministry of Education — Argentina
Argentina
The ransomware group "N0n" listed Ministry of Education — Argentina on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
MPA Pharma
Germany
The ransomware group "rhysida" listed MPA Pharma on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
PITTSRAD
United States
The ransomware group "Spirals" listed PITTSRAD on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Beckman Coulter, Inc
United States
The ransomware group "metaencryptor" listed Beckman Coulter, Inc on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
www.diakonie-apolda.de
Germany
The ransomware group "krybit" listed www.diakonie-apolda.de on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
ARDA
Unknown
The ransomware group "arcusmedia" listed ARDA on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Owen Leigh Optometry
United Kingdom
The ransomware group "dragonforce" listed Owen Leigh Optometry on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
gob.pe
Peru
The ransomware group "safepay" listed gob.pe on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Southern California Telephone Company
United States
The ransomware group "akira" listed Southern California Telephone Company on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
triniticaring.org
United States
The ransomware group "safepay" listed triniticaring.org on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
ACA Pescara
Italy
The ransomware group "thegentlemen" listed ACA Pescara on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Alicotrans
Brazil
The ransomware group "qilin" listed Alicotrans on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Apteki Mareshki
Bulgaria
The ransomware group "thegentlemen" listed Apteki Mareshki on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
BGR Energy Systems
India
The ransomware group "thegentlemen" listed BGR Energy Systems on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
comune.robeccosulnaviglio.mi.it
Italy
The ransomware group "lockbit5" listed comune.robeccosulnaviglio.mi.it on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Hattiesburg Eye Clinic
United States
The ransomware group "thegentlemen" listed Hattiesburg Eye Clinic on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
MedSkin Solutions Dr. Suwelack AG
Germany
The ransomware group "thegentlemen" listed MedSkin Solutions Dr. Suwelack AG on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
PANTHERx Rare
United States
The ransomware group "Storm" listed PANTHERx Rare on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
RoadEx America
United States
The ransomware group "qilin" listed RoadEx America on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Navitrans
Unknown
The ransomware group "emperador" listed Navitrans on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
vi***in
India
The ransomware group "AuditTeam" listed vi***in on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
capricornlogistics.com
South Africa
The ransomware group "krybit" listed capricornlogistics.com on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Namibian Defence Force
Namibia
The ransomware group "ransomhouse" listed Namibian Defence Force on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Independent news coverage →TOWN OF SUTTON | MASSACHUSETTS
United States
The ransomware group "global" listed TOWN OF SUTTON | MASSACHUSETTS on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
www.eac-airports.com
Kenya
The ransomware group "krybit" listed www.eac-airports.com on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
www.ibnsinatrust.com
United Arab Emirates
The ransomware group "krybit" listed www.ibnsinatrust.com on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
www.tender.mx
Mexico
The ransomware group "krybit" listed www.tender.mx on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Agencia Estatal de Meteorología
Spain
The ransomware group "Panzer" listed Agencia Estatal de Meteorología on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
duopharmabiotech.com
Malaysia
The ransomware group "ValenciaLeaks" listed duopharmabiotech.com on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Independent news coverage →hygear.com
Germany
The ransomware group "lockbit5" listed hygear.com on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Imperial Healthcare Solutions
United States
The ransomware group "qilin" listed Imperial Healthcare Solutions on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
namtheun2.com
Laos
The ransomware group "settra" listed namtheun2.com on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
General Santos Doctors Hospital
Philippines
The ransomware group "rhysida" listed General Santos Doctors Hospital on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Goldston Oil Corporation
United States
The ransomware group "Wallstreet" listed Goldston Oil Corporation on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
mankatoclinic.com
United States
The ransomware group "chaos" listed mankatoclinic.com on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
On Demand Occupational Medicine
United States
The ransomware group "Wallstreet" listed On Demand Occupational Medicine on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Bosnia and Herzegovina Mine Action Center
Bosnia & Herzegovina
The ransomware group "emperador" listed Bosnia and Herzegovina Mine Action Center on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Port of Tanjung Pelepas
Malaysia
The ransomware group "direwolf" listed Port of Tanjung Pelepas on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Independent news coverage →Brent Electric
United Kingdom
The ransomware group "akira" listed Brent Electric on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
palmettoeyeinstitute.com
United States
The ransomware group "safepay" listed palmettoeyeinstitute.com on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
recoverycafe.org
United States
The ransomware group "safepay" listed recoverycafe.org on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Red Star Oil
Serbia
The ransomware group "play" listed Red Star Oil on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Hologic, Inc.
United States
The ransomware group "metaencryptor" listed Hologic, Inc. on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Medela.com
Switzerland
The ransomware group "shinyhunters" listed Medela.com on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Precision Vehicle Logistics
United States
The ransomware group "direwolf" listed Precision Vehicle Logistics on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
S A Chile
Chile
The ransomware group "thegentlemen" listed S A Chile on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
ST Engineering
Singapore
The ransomware group "metaencryptor" listed ST Engineering on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
State of Florida DMV
United States
The ransomware group "shinyhunters" listed State of Florida DMV on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Wellness Partners network(combined revenue)
United States
The ransomware group "incransom" listed Wellness Partners network(combined revenue) on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
eAssist Dental Solutions
United States
The ransomware group "direwolf" listed eAssist Dental Solutions on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
evergenbio.com
United States
The ransomware group "chaos" listed evergenbio.com on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
myLaurel
United States
The ransomware group "direwolf" listed myLaurel on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
RTAD GOV MM
Myanmar (Burma)
The ransomware group "DYSPHOR1A" listed RTAD GOV MM on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Judicial Branch of the Province of Jujuy
Argentina
The ransomware group "emperador" listed Judicial Branch of the Province of Jujuy on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Lider Aviacao
Brazil
The ransomware group "thegentlemen" listed Lider Aviacao on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Mega Velocity
Mexico
The ransomware group "Vexy Ransomware" listed Mega Velocity on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Metrea LLC/Commuter Air Technology, Inc.
United States
The ransomware group "aurora" listed Metrea LLC/Commuter Air Technology, Inc. on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Mission Pet Health
United States
The ransomware group "direwolf" listed Mission Pet Health on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Philippine Ports Authority
Philippines
The ransomware group "qilin" listed Philippine Ports Authority on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Commission de la construction du Quebec (CCQ)
Canada
The ransomware group "qilin" listed Commission de la construction du Quebec (CCQ) on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
huisartsencentrumkleiniterson.nl
Netherlands
The ransomware group "lockbit5" listed huisartsencentrumkleiniterson.nl on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
kalahealth.eu
Germany
The ransomware group "lockbit5" listed kalahealth.eu on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Occidental
Venezuela
The ransomware group "gunra" listed Occidental on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Veradigm
United States
The ransomware group "thegentlemen" listed Veradigm on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Zdrowit
Poland
The ransomware group "thegentlemen" listed Zdrowit on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Dinas Komunikasi dan Informatika
Indonesia
The ransomware group "Panzer" listed Dinas Komunikasi dan Informatika on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Studio Oculistico Ciraci
Italy
The ransomware group "spacebears" listed Studio Oculistico Ciraci on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Grayson Rural Electric Cooperative
United States
The ransomware group "qilin" listed Grayson Rural Electric Cooperative on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Petrocare Construction
Canada
The ransomware group "Storm" listed Petrocare Construction on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
PTT Oil and Retail Business
Thailand
The ransomware group "direwolf" listed PTT Oil and Retail Business on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Star Aviation, Inc
United States
The ransomware group "Storm" listed Star Aviation, Inc on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Commission de la construction du Quebec
Canada
The ransomware group "qilin" listed Commission de la construction du Quebec on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
transportesmontejo.com
Mexico
The ransomware group "krybit" listed transportesmontejo.com on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Trucka
Mexico
The ransomware group "incransom" listed Trucka on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
KFZ-MEISTERBETRIEB JOST GmbH
Germany
The ransomware group "akira" listed KFZ-MEISTERBETRIEB JOST GmbH on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Transportes Montejo S.A.S.
Colombia
The ransomware group "nightspire" listed Transportes Montejo S.A.S. on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Perimetral Oriental de Bogotá S.A.S.
Colombia
The ransomware group "nightspire" listed Perimetral Oriental de Bogotá S.A.S. on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Directorate-General for Education
Portugal
The ransomware group "Panzer" listed Directorate-General for Education on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
ESB Puerto Rico Corp
Puerto Rico
The ransomware group "thegentlemen" listed ESB Puerto Rico Corp on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Hanwha Renewables
South Korea
The ransomware group "emperador" listed Hanwha Renewables on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Oilquip Inc
United States
The ransomware group "incransom" listed Oilquip Inc on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Servicios Aereos Estrella
Mexico
The ransomware group "thegentlemen" listed Servicios Aereos Estrella on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
SITTNAK Lojistik A.Ş.
Türkiye
The ransomware group "Doommageddon" listed SITTNAK Lojistik A.Ş. on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Tramigo
Finland
The ransomware group "qilin" listed Tramigo on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Whitehouse
United Kingdom
The ransomware group "qilin" listed Whitehouse on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Capitol Mechanics
United States
The ransomware group "emperador" listed Capitol Mechanics on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Globalport Terminals
Philippines
The ransomware group "qilin" listed Globalport Terminals on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
California Truck Equipment
United States
The ransomware group "qilin" listed California Truck Equipment on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
KenEp Resources
Malaysia
The ransomware group "qilin" listed KenEp Resources on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Manchester Airports Group
United Kingdom
The ransomware group "fulcrumsec" listed Manchester Airports Group on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Independent news coverage →ATF
United States
The ransomware group "qilin" listed ATF on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Independent news coverage →Lockheed Architectural Solutions, Inc.
United States
The ransomware group "Global Secret Group" listed Lockheed Architectural Solutions, Inc. on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
The Merrimack County
United States
The ransomware group "Booba Project" listed The Merrimack County on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Independent news coverage →Tiseo Paving
United States
The ransomware group "Global Secret Group" listed Tiseo Paving on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Government of Vojvodina
Serbia
The ransomware group "Panzer" listed Government of Vojvodina on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Global Go
Peru
The ransomware group "killsec" listed Global Go on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Sharp Motor Group
Australia
The ransomware group "Storm" listed Sharp Motor Group on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Ville de Libercourt
France
The ransomware group "kairos" listed Ville de Libercourt on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Independent news coverage →Weber Water Resources
United States
The ransomware group "metaencryptor" listed Weber Water Resources on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
AmSpec
United States
The ransomware group "Helix" listed AmSpec on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
CRI Electric
United States
The ransomware group "rhysida" listed CRI Electric on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Flecha Bus
Argentina
The ransomware group "coinbasecartel" listed Flecha Bus on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Meridian Logistics Group
United States
The ransomware group "thegentlemen" listed Meridian Logistics Group on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Vietnam Electricity(EVNHANOI)
Vietnam
The ransomware group "emperador" listed Vietnam Electricity(EVNHANOI) on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Aquasea
Norway
The ransomware group "thegentlemen" listed Aquasea on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Ariel Energia
Italy
The ransomware group "thegentlemen" listed Ariel Energia on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
HP Carriers
United States
The ransomware group "direwolf" listed HP Carriers on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Oceanica Internacional
Samoa
The ransomware group "thegentlemen" listed Oceanica Internacional on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Pertamina
Indonesia
The ransomware group "ransomhouse" listed Pertamina on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Quaker State Mexico
Mexico
The ransomware group "qilin" listed Quaker State Mexico on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Yoma Fleet
Myanmar (Burma)
The ransomware group "DYSPHOR1A" listed Yoma Fleet on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Indonesian Police Database
Indonesia
The ransomware group "DYSPHOR1A" listed Indonesian Police Database on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Babcock
South Africa
The ransomware group "thegentlemen" listed Babcock on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Delek US
United States
The ransomware group "Helix" listed Delek US on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Global Terminal Services
Türkiye
The ransomware group "Deadlock" listed Global Terminal Services on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Shanghai Tunnel Engineering Co Ltd
China
The ransomware group "global" listed Shanghai Tunnel Engineering Co Ltd on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Smart Energies
Germany
The ransomware group "qilin" listed Smart Energies on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
WIS LOGISTICS
United States
The ransomware group "qilin" listed WIS LOGISTICS on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
HEOLIS
France
The ransomware group "ZaWoo" listed HEOLIS on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Prefeitura Municipal de Arcos
Brazil
The ransomware group "emperador" listed Prefeitura Municipal de Arcos on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Roadvision Systems
Sweden
The ransomware group "thegentlemen" listed Roadvision Systems on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Castilla La Mancha
Spain
The ransomware group "Panzer" listed Castilla La Mancha on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Valor Defense Solutions, Inc
United States
The ransomware group "Storm" listed Valor Defense Solutions, Inc on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
City of Fort Smith Arkansas
United States
The ransomware group "interlock" listed City of Fort Smith Arkansas on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Independent news coverage →Pierce Township
United States
The ransomware group "rhysida" listed Pierce Township on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Ayuntamiento de Velilla de San Antonio
Spain
The ransomware group "kairos" listed Ayuntamiento de Velilla de San Antonio on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
BEDC.COM.AU
Australia
The ransomware group "incransom" listed BEDC.COM.AU on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
CALICHE
Chile
The ransomware group "majinahanashi" listed CALICHE on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Otter Tail County, Minnesota
United States
The ransomware group "incransom" listed Otter Tail County, Minnesota on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
City Government of Baguio
Philippines
The ransomware group "emperador" listed City Government of Baguio on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
City of Winchester
United States
The ransomware group "qilin" listed City of Winchester on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Elettrica System
Italy
The ransomware group "bravox" listed Elettrica System on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
terra-petra.com
Germany
The ransomware group "lockbit5" listed terra-petra.com on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Energetic Development Corp
Taiwan
The ransomware group "qilin" listed Energetic Development Corp on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Naval Interior Team
Finland
The ransomware group "qilin" listed Naval Interior Team on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
pm-energy Die Solarexperten
Germany
The ransomware group "qilin" listed pm-energy Die Solarexperten on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Siam Oil Product
Thailand
The ransomware group "Panzer" listed Siam Oil Product on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
AmSpec
United States
The ransomware group "qilin" listed AmSpec on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
SHELL.COM (August 2026)
United Kingdom
The ransomware group "clop" listed SHELL.COM (August 2026) on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Reid Electric Service, Inc
United States
The ransomware group "Dark Project" listed Reid Electric Service, Inc on its leak site, claiming an attack. This is an unverified claim from the attackers' own site, not a confirmed breach notification.
Ascension Health Ransomware Attack
United States · 5,600,000 affected
Ransomware attack on a major nonprofit hospital network reportedly forced ambulance diversions and weeks of electronic health record downtime across dozens of hospitals.
Change Healthcare Ransomware Attack →
United States · 100,000,000 affected
Ransomware attack on a healthcare billing/claims clearinghouse froze prescription and insurance processing nationwide for weeks. Later confirmed as the largest healthcare data breach disclosed in the US to date.
Prospect Medical Holdings Ransomware Attack
United States
Ransomware forced hospitals across multiple states to divert ambulances and revert to paper records for days, disrupting a multi-state hospital and clinic network.
HCA Healthcare Data Theft →
United States · 11,000,000 affected
Data believed to have been stolen from an external storage location used to format patient email communications, exposing contact and demographic information.
MOVEit Transfer Mass Exploitation →
United States · 93,000,000 affected
A zero-day flaw in widely used file-transfer software was exploited at scale, affecting thousands of downstream organizations across healthcare, government, and finance in a single supply-chain incident.
Volt Typhoon Critical Infrastructure Pre-positioning
United States
A joint US/allied government advisory revealed a Chinese state-linked group had quietly maintained long-term access inside power, water, and communications networks — not to steal data, but reportedly to preposition for potential future disruption during a crisis.
CommonSpirit Health Ransomware Attack
United States · 623,000 affected
Ransomware attack on one of the largest US hospital chains reportedly disrupted electronic health records and patient care across multiple states for several weeks.
Costa Rica Government Ransomware Attacks →
Costa Rica
Conti ransomware crippled dozens of government ministries — disrupting tax collection, foreign trade, and public health payroll systems — prompting the president to declare a national emergency, a rare country-wide response to a cyberattack.
Colonial Pipeline Ransomware Attack →
United States
Ransomware attack on IT systems led Colonial Pipeline to proactively shut down the largest fuel pipeline in the US, triggering regional gas shortages. Traced to a single compromised VPN password without multi-factor authentication.
Scripps Health Ransomware Attack
United States · 1,200,000 affected
Ransomware attack on a San Diego hospital system reportedly forced a month-long return to paper records and ambulance diversions.
Oldsmar Water Treatment Plant Intrusion →
United States
An attacker briefly gained remote access to a Florida water treatment plant's control software and increased sodium hydroxide levels to a dangerous concentration. Caught and reversed immediately by a plant operator.
Universal Health Services Ransomware Attack
United States
Ryuk ransomware reportedly disrupted systems across roughly 400 facilities of one of the largest US hospital chains, forcing a return to manual, paper-based operations nationwide.
Blackbaud Ransomware Attack
United States
A ransomware attack on a fundraising-software vendor used widely by hospitals, universities, and nonprofits exposed donor and patient data across hundreds of downstream organizations that never directly used the compromised system's public-facing services.
Israeli Water Facility Intrusions
Israel
Reported attempts to access control systems at multiple Israeli water facilities and alter chlorine levels, attributed by officials to Iran-linked actors. No confirmed harm to water supply resulted.
City of New Orleans Ransomware Attack
United States
A ransomware attack forced the city to shut down its entire IT network and declare a state of emergency, taking municipal services offline for weeks.
American Medical Collection Agency (AMCA) Breach →
United States · 20,000,000 affected
A breach at a billing collections vendor cascaded to its healthcare clients — including major lab testing companies Quest Diagnostics and LabCorp — exposing financial and medical data for over 20 million people combined.
Norsk Hydro Ransomware Attack →
Norway
LockerGoga ransomware forced one of the world's largest aluminum producers to switch to manual operations across plants worldwide. Widely cited as a model response: the company refused to pay the ransom and published transparent, ongoing updates through recovery, later estimated to cost over $70 million.
City of Atlanta Ransomware Attack
United States
SamSam ransomware took down city services including courts, police records, and online bill payment for days, with recovery costs later estimated in the tens of millions of dollars.
Triton/Trisis Safety System Attack
Saudi Arabia
Malware targeted the safety instrumented systems of a petrochemical plant — the systems specifically designed to prevent catastrophic accidents. A bug in the attackers' own code reportedly triggered a safe shutdown before harm occurred.
WannaCry Ransomware Outbreak (NHS Impact)
United Kingdom
A self-spreading ransomware worm exploiting an unpatched Windows flaw hit the UK's National Health Service particularly hard, reportedly leading to thousands of cancelled appointments and diverted emergency care.
Ukraine Power Grid Attack (Industroyer)
Ukraine
A follow-up attack used purpose-built malware (Industroyer/CrashOverride) designed specifically to speak the communication protocols of power grid control systems, briefly cutting power in part of Kyiv.
San Francisco Muni Ransomware Attack
United States
Ransomware took San Francisco's light-rail fare payment systems offline over Thanksgiving weekend, displaying "You Hacked, ALL Data Encrypted" on station terminals; the transit agency let riders travel fare-free rather than pay the ransom.
Banner Health Data Breach
United States · 3,700,000 affected
Attackers reportedly gained access through payment card systems at food and beverage outlets before pivoting to patient and health plan data across the hospital network.
Ukraine Power Grid Attack (BlackEnergy)
Ukraine · 230,000 affected
Widely regarded as the first confirmed blackout caused by a cyberattack. Attackers linked to the Sandworm group remotely switched off substations, cutting power to an estimated 230,000 people.
Excellus BlueCross BlueShield Data Breach
United States · 10,000,000 affected
One of several major health insurer breaches disclosed in 2015; attackers reportedly had undetected network access for roughly two years before discovery.
US Office of Personnel Management Data Breach →
United States · 21,500,000 affected
Attackers linked by investigators to Chinese state-sponsored actors stole highly sensitive federal background-check records, including fingerprints and security-clearance details, in one of the most damaging government breaches on record.
Premera Blue Cross Data Breach
United States · 11,000,000 affected
Attackers reportedly had undetected access to a health insurer's network for close to a year before the breach was discovered, exposing medical and financial data.
Anthem Inc. Data Breach
United States · 78,800,000 affected
One of the largest healthcare data breaches on record at the time; attackers accessed a major health insurer's systems and exposed names, birthdates, and Social Security numbers.
Community Health Systems Data Breach
United States · 4,500,000 affected
Attackers linked by investigators to a China-based group reportedly stole patient data from one of the largest US hospital operators using a known server vulnerability.
Advocate Medical Group Data Breach
United States · 4,000,000 affected
Four unencrypted desktop computers containing patient billing data were stolen from an administrative office, one of the largest healthcare breaches of its time and a widely cited case for why encryption-at-rest matters.
No incidents match those filters.