brain cipher
Active30 claimed victims
The claims below are reproduced as posted by brain cipher on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Brain Cipher ransomware surfaced in mid-2024, rapidly gaining notoriety after a high-impact attack on Indonesia’s National Data Center, which disrupted over 160 government services including immigration systems. The group operates with a double-extortion model, encrypting data using a LockBit 3.0-based payload (Salsa20/RSA hybrid) and threatening leaks via a Tor-hosted portal. Distinct behaviors include encrypting both file contents and filenames, and customizing encrypted file names with appended random extensions.
Description from RansomLook (CC BY 4.0).
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| mvjllp.com | October 21, 2026 | ransomlook | — |
| olyortho.com | October 21, 2026 | ransomlook | — |
| prosomnus.com | October 21, 2026 | ransomlook | — |
| srsnodgrass.com | October 21, 2026 | ransomlook | — |
| sodali.com | October 21, 2026 | ransomlook | — |
| clinicaromero.com | October 21, 2026 | ransomlook | — |
| oflaherty-law.com | October 21, 2026 | ransomlook | — |
| novagroupgbc.com | October 21, 2026 | ransomlook | — |
| Trailerbridge.com | October 12, 2026 | ransomlook | — |
| huntcompanies.com | October 9, 2026 | ransomlook | — |
| latitudesubro.com | September 29, 2026 | ransomlook | — |
| maxwell-group.com | September 29, 2026 | ransomlook | — |
| wildmanbg.com | September 29, 2026 | ransomlook | — |
| mulholland.com | September 29, 2026 | ransomlook | — |
| northeastrehab.com | September 29, 2026 | ransomlook | — |
| goriteway.com | September 29, 2026 | ransomlook | — |
| mccordclaims.com | September 29, 2026 | ransomlook | — |
| trailerbridge.com | September 29, 2026 | ransomlook | — |
| goldstarfinancial.com | September 23, 2026 | ransomlook | — |
| aecom.com | September 17, 2026 | ransomlook | — |
| hoyletanner.com | September 17, 2026 | ransomlook | — |
| xpera.ca | September 17, 2026 | ransomlook | — |
| ccsperfusion.com | August 31, 2026 | ransomlook | — |
| crmeyer.com | August 31, 2026 | ransomlook | — |
| sago.com | August 31, 2026 | ransomlook | — |
| ahadandco.com | August 31, 2026 | ransomlook | — |
| Adviesbureau De Beuckelaer BV | August 31, 2026 | ransomlook | — |
| syc.es | August 31, 2026 | ransomlook | — |
| aeiconsultants.com | August 31, 2026 | ransomlook | — |
| icot.es | August 31, 2026 | ransomlook | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).