chaos
First seen March 31, 2025Active96 claimed victims
The claims below are reproduced as posted by chaos on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Chaos is a ransomware-as-a-service operation that emerged in early 2025, likely formed by former BlackSuit/Royal members, offering cross-platform ransomware for Windows, Linux, ESXi, and NAS to affiliates recruited on the RAMP dark web forum, excluding CIS/BRICS countries and hospitals from targeting.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| astranahealth.com | October 10, 2026 | ransomlook | — |
| parkdental.com | October 1, 2026 | ransomlook | — |
| advantech.com | September 29, 2026 | ransomlook | — |
| carolinaasthma.com | September 29, 2026 | ransomlook | — |
| expresspros.com | September 17, 2026 | ransomlook | — |
| steelhausinc.com | September 14, 2026 | ransomlook | — |
| glasfloss.com | September 14, 2026 | ransomlook | — |
| artiflexmfg.com | September 10, 2026 | ransomlook | — |
| mankatoclinic.com | September 10, 2026 | ransomlook | — |
| copeplastics.com | September 9, 2026 | ransomlook | — |
| evergenbio.com | September 6, 2026 | ransomlook | — |
| macallister.com | August 28, 2026 | ransomlook | — |
| corematerials.com | August 28, 2026 | ransomlook | — |
| singleton.com | August 27, 2026 | ransomlook | — |
| copcp.com | August 25, 2026 | ransomlook | — |
| mswalker.com | August 25, 2026 | ransomlook | — |
| parkderochie.com | August 25, 2026 | ransomlook | — |
| tomorrowsoffice.com | August 5, 2026 | ransomware_live | — |
| healthcarehighways.com | August 4, 2026 | ransomware_live | — |
| thecranewaregroup.com | July 28, 2026 | ransomware_live | — |
| vit-best.com | July 27, 2026 | ransomware_live | — |
| remco.ca | July 26, 2026 | ransomware_live | — |
| issvc.com | July 22, 2026 | ransomware_live | — |
| neopharmlabs.com | July 22, 2026 | ransomware_live | — |
| argonautms.com | July 21, 2026 | ransomware_live | — |
| wikoff.com | July 20, 2026 | ransomware_live | — |
| radiax.com | July 16, 2026 | ransomware_live | — |
| aphenapharma.com | July 14, 2026 | ransomware_live | — |
| spectrumchemical.com | July 14, 2026 | ransomware_live | — |
| sleemanbreweries.ca | July 14, 2026 | ransomware_live | — |
| corepharma.com | July 8, 2026 | ransomware_live | — |
| opportune.com | July 8, 2026 | ransomware_live | — |
| aircreebec.ca | July 6, 2026 | ransomware_live | — |
| gisy.com | July 6, 2026 | ransomware_live | — |
| universalplant.com | June 30, 2026 | ransomware_live | — |
| ingerman.com | June 26, 2026 | ransomware_live | — |
| roofdepot.com | June 25, 2026 | ransomware_live | — |
| randa.net | June 23, 2026 | ransomware_live | — |
| graymont.com | June 22, 2026 | ransomware_live | — |
| airespring.com | June 9, 2026 | ransomware_live | — |
| entransinternational.com | May 28, 2026 | ransomware_live | — |
| powerhousenow.com | May 28, 2026 | ransomware_live | — |
| sterlingindustries.com | May 27, 2026 | ransomware_live | — |
| fallprotect.com | May 17, 2026 | ransomware_live | — |
| cstindustries.com | May 17, 2026 | ransomware_live | — |
| wtitransport.com | May 17, 2026 | ransomware_live | — |
| challenge-mfg.com | May 17, 2026 | ransomware_live | — |
| www.cswindustrials.com | May 4, 2026 | ransomware_live | — |
| vacaero.com | May 4, 2026 | ransomware_live | — |
| cadencepetroleum.com | April 28, 2026 | ransomware_live | — |
| itc-group.com | April 14, 2026 | ransomware_live | — |
| coastappliances.com | April 14, 2026 | ransomware_live | — |
| kdmpop.com | March 27, 2026 | ransomware_live | — |
| flad.com | March 12, 2026 | ransomware_live | — |
| nelsonworldwide.com | March 6, 2026 | ransomware_live | — |
| milespartnership.com | February 26, 2026 | ransomware_live | — |
| CEIVA Logic | January 5, 2026 | ransomware_live | — |
| VEPLASTIC | December 26, 2025 | ransomware_live | — |
| NSE Insurance Agencies | December 11, 2025 | ransomware_live | — |
| thinkmarkets.com | December 8, 2025 | ransomware_live | — |
| b2be.com | December 8, 2025 | ransomware_live | — |
| dakkota.com | December 2, 2025 | ransomware_live | — |
| lesker.com | December 2, 2025 | ransomware_live | — |
| mToilet | November 23, 2025 | ransomware_live | — |
| Metropolitan Adjustment Bureau | November 13, 2025 | ransomware_live | — |
| iconinternational.com | November 12, 2025 | ransomware_live | — |
| DeCeTe | October 28, 2025 | ransomware_live | — |
| AutohausMalin | October 7, 2025 | ransomware_live | — |
| archway.com | October 7, 2025 | ransomware_live | — |
| indiesemi.com | October 7, 2025 | ransomware_live | — |
| ebaengineering.com | October 7, 2025 | ransomware_live | — |
| amsfulfillment.com | September 24, 2025 | ransomware_live | — |
| ellison-mills.com | September 1, 2025 | ransomware_live | — |
| dafo.se | August 27, 2025 | ransomware_live | — |
| Optima Tax Relief | June 6, 2025 | ransomware_live | — |
| Veethree | June 5, 2025 | ransomware_live | — |
| The Salvation Army | May 27, 2025 | ransomware_live | — |
| Transcore | March 31, 2025 | ransomware_live | — |
| Evans Distribution Systems | March 31, 2025 | ransomware_live | — |
| Pak Technologies | March 31, 2025 | ransomware_live | — |
| goosehead.com | March 15, 2025 | ransomware_live | — |
| www.rocketstores.com | February 26, 2025 | ransomware_live | — |
| farmerbros.com | February 19, 2025 | ransomware_live | — |
| iescomm.com | February 19, 2025 | ransomware_live | — |
| Barnhartcrane.com | February 19, 2025 | ransomware_live | — |
| www.msssolutions.com | February 19, 2025 | ransomware_live | — |
| hanson-inc.com | February 19, 2025 | ransomware_live | — |
| amsino.com | February 19, 2025 | ransomware_live | — |
| anomatic.com | February 19, 2025 | ransomware_live | — |
| horizonmedia.com | February 19, 2025 | ransomware_live | — |
| ntic.com | February 19, 2025 | ransomware_live | — |
| crescentenergyco.com | February 19, 2025 | ransomware_live | — |
| loopcap.com | February 19, 2025 | ransomware_live | — |
| smythco.com | February 19, 2025 | ransomware_live | — |
| polycorp.com | February 19, 2025 | ransomware_live | — |
| alexandergroup.com | February 19, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).