abyss
First seen March 21, 2023Active91 claimed victims
The claims below are reproduced as posted by abyss on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Abyss (also known as Abyss Locker) is a ransomware operation first identified in March 2023, derived from the Babuk source code, that targets Windows and Linux/VMware ESXi systems using double-extortion tactics across healthcare, manufacturing, finance, and technology sectors — predominantly in North America.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| MEMSIC | August 26, 2026 | ransomware_live | — |
| landkreis-limburg-weilburg.de | June 1, 2026 | ransomware_live | — |
| School Facility Consultants | June 1, 2026 | ransomware_live | — |
| technic.com | May 14, 2026 | ransomware_live | — |
| thinlinetech.com | February 26, 2026 | ransomware_live | — |
| sitoy.com | January 26, 2026 | ransomware_live | — |
| dillonyarn.com | December 10, 2025 | ransomware_live | — |
| optimumdesign.com | September 22, 2025 | ransomware_live | — |
| moinian.com | September 11, 2025 | ransomware_live | — |
| hptc.org | July 26, 2025 | ransomware_live | — |
| crownlaboratories.com | April 2, 2025 | ransomware_live | — |
| entandallergy.com | March 28, 2025 | ransomware_live | — |
| mdm-insurance.com | March 14, 2025 | ransomware_live | — |
| ceratec.com | March 3, 2025 | ransomware_live | — |
| halex.com | February 15, 2025 | ransomware_live | — |
| jpcgroupinc.com | February 2, 2025 | ransomware_live | — |
| Four Eye Clinics | February 2, 2025 | ransomware_live | — |
| envirosep.com | January 25, 2025 | ransomware_live | — |
| kingpower.com | January 8, 2025 | ransomware_live | — |
| berkotfoods.com | December 21, 2024 | ransomware_live | — |
| bataviacontainer.com | December 19, 2024 | ransomware_live | — |
| pez.com | December 6, 2024 | ransomware_live | — |
| glts.net | November 25, 2024 | ransomware_live | — |
| projektalp.ch | October 29, 2024 | ransomware_live | — |
| anhf.org.auh | October 29, 2024 | ransomware_live | — |
| Promise Technology, Inc. | October 15, 2024 | ransomware_live | — |
| In the depths of software development. | October 15, 2024 | ransomware_live | — |
| promise.com | October 11, 2024 | ransomware_live | — |
| victrongroup.com | October 9, 2024 | ransomware_live | — |
| tolsa.com | September 26, 2024 | ransomware_live | — |
| f-t.com | September 23, 2024 | ransomware_live | — |
| tims.com | September 19, 2024 | ransomware_live | — |
| ecbawm.com | September 14, 2024 | ransomware_live | — |
| pfsbrands.com | August 30, 2024 | ransomware_live | — |
| comtruck.ca | August 28, 2024 | ransomware_live | — |
| idahopacific.com | August 23, 2024 | ransomware_live | — |
| spvmhc.org | August 21, 2024 | ransomware_live | — |
| robertshvac.com | August 11, 2024 | ransomware_live | — |
| q-cells.de | August 2, 2024 | ransomware_live | — |
| zoppo.com | July 28, 2024 | ransomware_live | — |
| crimsonwinegroup.com | July 25, 2024 | ransomware_live | — |
| greenlightbiosciences.com | July 15, 2024 | ransomware_live | — |
| conferenceusa.com | June 27, 2024 | ransomware_live | — |
| landmarklife.com | June 27, 2024 | ransomware_live | — |
| tpocc.org | June 25, 2024 | ransomware_live | — |
| malca-amit.com | June 18, 2024 | ransomware_live | — |
| woldae.com | May 7, 2024 | ransomware_live | — |
| rangam.com | April 23, 2024 | ransomware_live | — |
| rameywine.com | March 29, 2024 | ransomware_live | — |
| lindquistinsurance.com | March 27, 2024 | ransomware_live | — |
| yarco.com | March 14, 2024 | ransomware_live | — |
| iamdesign.com | March 14, 2024 | ransomware_live | — |
| neigc.com | March 11, 2024 | ransomware_live | — |
| sunharbormanor.com | February 29, 2024 | ransomware_live | — |
| vanwingerden.com | February 14, 2024 | ransomware_live | — |
| mranet.org | February 10, 2024 | ransomware_live | — |
| posen.com | February 9, 2024 | ransomware_live | — |
| transaxle.com | February 7, 2024 | ransomware_live | — |
| deltron.com | February 6, 2024 | ransomware_live | — |
| vidalung.ai | January 27, 2024 | ransomware_live | — |
| micrometals.com | January 23, 2024 | ransomware_live | — |
| synergyfinancialgrp.com | January 23, 2024 | ransomware_live | — |
| concertus.co.uk | December 5, 2023 | ransomware_live | — |
| aurobindousa.com | November 30, 2023 | ransomware_live | — |
| motordepot.co.uk | November 11, 2023 | ransomware_live | — |
| shawneemilling.com | November 11, 2023 | ransomware_live | — |
| lathamcenters.org | November 5, 2023 | ransomware_live | — |
| apexga.bank | October 26, 2023 | ransomware_live | — |
| njsba.com | September 10, 2023 | ransomware_live | — |
| www.northriverco.com | September 8, 2023 | ransomware_live | — |
| www.lasaterandmartin.com | August 31, 2023 | ransomware_live | — |
| www.finitia.net | August 9, 2023 | ransomware_live | — |
| plbint.com | July 21, 2023 | ransomware_live | — |
| www.brockhouse.co.uk | July 18, 2023 | ransomware_live | — |
| www.tractrad.com | July 17, 2023 | ransomware_live | — |
| www.arb.ch | July 16, 2023 | ransomware_live | — |
| www.stri.se | July 16, 2023 | ransomware_live | — |
| wsots.net | May 15, 2023 | ransomware_live | — |
| www.l3harris.com | May 15, 2023 | ransomware_live | — |
| pwlawfirm.com | May 12, 2023 | ransomware_live | — |
| avidxchange.com | May 8, 2023 | ransomware_live | — |
| brett-robinson.com | May 8, 2023 | ransomware_live | — |
| pandol.com | April 18, 2023 | ransomware_live | — |
| 7x7oralsurgery.com | March 30, 2023 | ransomware_live | — |
| bienvilleortho.com | March 27, 2023 | ransomware_live | — |
| largest provider of orthopedic care | March 22, 2023 | ransomware_live | — |
| siebold.com | March 21, 2023 | ransomware_live | — |
| stonehillcontracting.com | March 21, 2023 | ransomware_live | — |
| jones-hamilton.com | March 21, 2023 | ransomware_live | — |
| igadiltd.com | March 21, 2023 | ransomware_live | — |
| hosemanufacturing.com | March 21, 2023 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).