AiLock
Also known as: ailockFirst seen March 3, 2026Active51 claimed victims
The claims below are reproduced as posted by AiLock on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
AiLock is a ransomware operation that emerged in early 2025, marketing itself as AI-assisted ransomware using a hybrid ChaCha20/NTRUEncrypt encryption scheme and double-extortion tactics, actively recruiting affiliates and threatening regulatory reporting if ransoms are unpaid.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Hamilton | August 26, 2026 | ransomlook | — |
| Morgan Services | August 26, 2026 | ransomlook | — |
| Yaomasa | August 13, 2026 | ransomware_live | — |
| DAISEN | August 13, 2026 | ransomware_live | — |
| Ferrovial | July 15, 2026 | ransomware_live | — |
| Solid Advance Inc. | July 15, 2026 | ransomware_live | — |
| Nihon Kotsu Co., Ltd. | July 15, 2026 | ransomware_live | — |
| WBF Construction | July 14, 2026 | ransomware_live | — |
| Pinturas Prisa | July 9, 2026 | ransomware_live | — |
| Richmont Graduate University | July 7, 2026 | ransomware_live | — |
| Studio Sardano | July 7, 2026 | ransomware_live | — |
| Hokua | June 26, 2026 | ransomware_live | — |
| Röben Tonbaustoffe GmbH | June 15, 2026 | ransomware_live | — |
| Groupe Sécurité CLB | June 4, 2026 | ransomware_live | — |
| Schneebeli | June 1, 2026 | ransomware_live | — |
| Restorative Therapies, Inc. | May 29, 2026 | ransomware_live | — |
| Artso International, Inc. | May 24, 2026 | ransomware_live | — |
| Jazz Hipster | May 18, 2026 | ransomware_live | — |
| Design Engineering & Consulting | May 18, 2026 | ransomware_live | — |
| Accretech America Inc. | May 11, 2026 | ransomware_live | — |
| Site Design Group | May 2, 2026 | ransomware_live | — |
| Raich Sp. z o.o. | April 27, 2026 | ransomware_live | — |
| Mother's Market & Kitchen | April 23, 2026 | ransomware_live | — |
| PremCom | April 22, 2026 | ransomware_live | — |
| Alvi Associates | April 10, 2026 | ransomware_live | — |
| Piet Vijverberg | April 3, 2026 | ransomware_live | — |
| Berning & Söhne GmbH | April 3, 2026 | ransomware_live | — |
| Solutions Extreme Technology | March 17, 2026 | ransomware_live | — |
| England Hockey | March 12, 2026 | ransomware_live | — |
| Eeyou Communications Network | March 7, 2026 | ransomware_live | — |
| Netwerk NV | March 7, 2026 | ransomware_live | — |
| Johnson Vollmerhausen & Gates | March 7, 2026 | ransomware_live | — |
| ELO Digital Office | March 3, 2026 | ransomware_live | — |
| Aaronson Rappaport Feinstein & Deutsch | March 3, 2026 | ransomware_live | — |
| Demanor | March 3, 2026 | ransomware_live | — |
| Dallas Regional Chamber | January 24, 2026 | ransomware_live | — |
| ShopBot Tools | January 16, 2026 | ransomware_live | — |
| Navicore Solutions | January 11, 2026 | ransomware_live | — |
| Emanuelson-Podas | January 10, 2026 | ransomware_live | — |
| S&R Compression, LLC | January 10, 2026 | ransomware_live | — |
| Professional Retail Outlet Services | January 9, 2026 | ransomware_live | — |
| Promotion Management Center | October 14, 2025 | ransomware_live | — |
| Sterling Industries | October 11, 2025 | ransomware_live | — |
| Raw Seafoods | July 24, 2025 | ransomware_live | — |
| FUJIFILM Speciality Ink Systems | July 21, 2025 | ransomware_live | — |
| Lewis Drug | July 6, 2025 | ransomware_live | — |
| HomeSite Services | June 17, 2025 | ransomware_live | — |
| AJ Networks | April 17, 2025 | ransomware_live | — |
| Integral Analytics | April 10, 2025 | ransomware_live | — |
| Transsion | March 29, 2025 | ransomware_live | — |
| Revival Animal Health | April 29, 2015 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).