bravox
First seen February 11, 2026Active40 claimed victims
The claims below are reproduced as posted by bravox on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
BravoX is a selective ransomware-as-a-service operation that surfaced publicly in January 2026 after advertising on the RAMP underground forum, targeting primarily US-based organizations in healthcare and retail while applying strict affiliate vetting requirements including proof of access or a financial deposit.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Barrow & Grimm | October 22, 2026 | ransomware_live | — |
| AMSAM | October 22, 2026 | ransomware_live | — |
| AMSAM 🇫🇷 | October 22, 2026 | ransomlook | — |
| Barrow & Grimm 🇺🇸 | October 22, 2026 | ransomlook | — |
| GSE-M Technology Sdn. Bhd. | October 21, 2026 | ransomware_live | — |
| GSE-M Technology Sdn. Bhd. 🇲🇾 | October 21, 2026 | ransomlook | — |
| Minkon 🇩🇪 | October 17, 2026 | ransomlook | — |
| Minkon | October 16, 2026 | ransomware_live | — |
| Dudley Land Company | October 9, 2026 | ransomware_live | — |
| Dudley Land Company 🇺🇸 | October 9, 2026 | ransomlook | — |
| TOWILL | September 20, 2026 | ransomware_live | — |
| TOWILL 🇺🇸 | September 20, 2026 | ransomlook | — |
| SCHMIDT | September 1, 2026 | ransomware_live | — |
| SCHMIDT 🇺🇸 | September 1, 2026 | ransomlook | — |
| Moores | August 17, 2026 | ransomware_live | — |
| Verona 83 | August 10, 2026 | ransomware_live | — |
| Elettrica System | August 10, 2026 | ransomware_live | — |
| MEDICOS | August 7, 2026 | ransomware_live | — |
| MITC AG | August 6, 2026 | ransomware_live | — |
| A&A Safety | July 25, 2026 | ransomware_live | — |
| PB Fiduciaire SA | July 7, 2026 | ransomware_live | — |
| Meta | June 23, 2026 | ransomware_live | — |
| SELECT WINES | June 18, 2026 | ransomware_live | — |
| CCS GLOBAL TECH | June 12, 2026 | ransomware_live | — |
| Grupo Mauá | May 31, 2026 | ransomware_live | — |
| AcademyHealth | May 29, 2026 | ransomware_live | — |
| Salvation Army | May 23, 2026 | ransomware_live | — |
| Emek Elektrik | May 23, 2026 | ransomware_live | — |
| Rivadeneyra Treviño | May 12, 2026 | ransomware_live | — |
| Soprolux | May 7, 2026 | ransomware_live | — |
| 1st Solution CTC | April 23, 2026 | ransomware_live | — |
| Aculab | April 6, 2026 | ransomware_live | — |
| UMBERG TREUHAND AG | March 11, 2026 | ransomware_live | — |
| Soreco | March 2, 2026 | ransomware_live | — |
| OEC Bretagne | February 16, 2026 | ransomware_live | — |
| John O's Foods | February 11, 2026 | ransomware_live | — |
| FUSION HILL | February 11, 2026 | ransomware_live | — |
| SPEC | February 11, 2026 | ransomware_live | — |
| Hood River Dental | December 16, 2025 | ransomware_live | — |
| WVPCA | May 15, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).