cicada3301
First seen June 20, 2024Active75 claimed victims
The claims below are reproduced as posted by cicada3301 on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Cicada3301 is a ransomware-as-a-service group (tracked as Repellent Scorpius by Palo Alto) that emerged in mid-2024 using Rust-based ransomware targeting Windows, Linux, and ESXi systems, suspected to be a successor of BlackCat/ALPHV and running an affiliate program with 20% commissions.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| CI Engineering | September 4, 2025 | ransomware_live | — |
| Sensical | July 18, 2025 | ransomware_live | — |
| Burnham Nationwide | July 18, 2025 | ransomware_live | — |
| B&M - Expertise - Audit | July 18, 2025 | ransomware_live | — |
| gatlogistica.com.br | July 18, 2025 | ransomware_live | — |
| diasdeprimavera.com.br | July 18, 2025 | ransomware_live | — |
| Сonasa | July 14, 2025 | ransomware_live | — |
| PACIFIC BIOLABS | July 10, 2025 | ransomware_live | — |
| Mack Energy Corp | July 9, 2025 | ransomware_live | — |
| Amazon Transportes | April 22, 2025 | ransomware_live | — |
| Natilait | April 22, 2025 | ransomware_live | — |
| Asesoría Bieito | April 22, 2025 | ransomware_live | — |
| Správa služeb hlavního města Prahy | April 9, 2025 | ransomware_live | — |
| Eagle Distilleries | April 5, 2025 | ransomware_live | — |
| I.A.T.S.E. Local 667/669 | March 25, 2025 | ransomware_live | — |
| MinebeaMitsumi Inc | March 22, 2025 | ransomware_live | — |
| Benjamin Consulting Services | February 25, 2025 | ransomware_live | — |
| Birdsall Muller LLC | February 24, 2025 | ransomware_live | — |
| Executive Agenda | February 24, 2025 | ransomware_live | — |
| The Northwestern Illinois Association | February 23, 2025 | ransomware_live | — |
| Northern Management | February 23, 2025 | ransomware_live | — |
| Goldstein Law Group, S.C. | February 23, 2025 | ransomware_live | — |
| Digital Technology Co., Ltd. | February 23, 2025 | ransomware_live | — |
| Johnson's Nursery | February 23, 2025 | ransomware_live | — |
| Substitute Teacher Service | February 8, 2025 | ransomware_live | — |
| Caliente Construction | February 4, 2025 | ransomware_live | — |
| Asterra Properties | February 4, 2025 | ransomware_live | — |
| Rivers Casino and Rush Street Gaming | February 4, 2025 | ransomware_live | — |
| SSMC | February 4, 2025 | ransomware_live | — |
| ISOR | January 3, 2025 | ransomware_live | — |
| Frameworks | December 20, 2024 | ransomware_live | — |
| Concession Peugeot | December 15, 2024 | ransomware_live | — |
| CK Technology Group | December 8, 2024 | ransomware_live | — |
| T-Space | October 19, 2024 | ransomware_live | — |
| Luxwood Software Tools | October 17, 2024 | ransomware_live | — |
| Racing Forensics Inc | October 17, 2024 | ransomware_live | — |
| RDC Control Ltd | October 17, 2024 | ransomware_live | — |
| Dubin Group | October 17, 2024 | ransomware_live | — |
| Centrillion Technologies | October 11, 2024 | ransomware_live | — |
| INDIBA Group | October 5, 2024 | ransomware_live | — |
| Conductive Containers, Inc | October 3, 2024 | ransomware_live | — |
| Crown Mortgage Company | September 24, 2024 | ransomware_live | — |
| Hughes Gill Cochrane Tinetti | September 24, 2024 | ransomware_live | — |
| Model Engineering | September 23, 2024 | ransomware_live | — |
| Capital Printing | September 20, 2024 | ransomware_live | — |
| John W. Brooker Co., CPAs | September 15, 2024 | ransomware_live | — |
| Bogdan Frasco, LLP | September 15, 2024 | ransomware_live | — |
| 株式会社ミヤキ | September 6, 2024 | ransomware_live | — |
| John W. Brooker & Co., CPAs | August 31, 2024 | ransomware_live | — |
| BLVD Residential INC | August 31, 2024 | ransomware_live | — |
| Bogdan & Frasco, LLP | August 31, 2024 | ransomware_live | — |
| Hofmann Malerei AG | August 24, 2024 | ransomware_live | — |
| EBA Ernest Bland Associates | August 22, 2024 | ransomware_live | — |
| UFCW Local 135 | August 22, 2024 | ransomware_live | — |
| Findel | August 21, 2024 | ransomware_live | — |
| Bayou DeSiard Country Club - Monroe, LA | August 18, 2024 | ransomware_live | — |
| Bayou DeSiard Country Club | August 18, 2024 | ransomware_live | — |
| christen-sanitaer.ch | August 17, 2024 | ransomware_live | — |
| Riley Pope & Laney | August 14, 2024 | ransomware_live | — |
| VVS-Eksperten | August 12, 2024 | ransomware_live | — |
| Silipos | August 5, 2024 | ransomware_live | — |
| Square One Coating Systems | August 3, 2024 | ransomware_live | — |
| Chama Gaucha | August 2, 2024 | ransomware_live | — |
| NARSTCO | July 25, 2024 | ransomware_live | — |
| Tri-Star Display | July 25, 2024 | ransomware_live | — |
| Voss Belting & Specialty | July 25, 2024 | ransomware_live | — |
| D&K Group, Inc. | July 25, 2024 | ransomware_live | — |
| Valley Bulk | July 25, 2024 | ransomware_live | — |
| Khoo and Company, Inc | July 24, 2024 | ransomware_live | — |
| Leech Lake Gaming | July 19, 2024 | ransomware_live | — |
| GroupePRO-B | July 16, 2024 | ransomware_live | — |
| Access Group | June 19, 2024 | ransomware_live | — |
| Maintel | June 19, 2024 | ransomware_live | — |
| Basement Systems | June 18, 2024 | ransomware_live | — |
| ASST Rhodense | June 4, 2024 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).