ciphbit
First seen September 14, 2023Active36 claimed victims
The claims below are reproduced as posted by ciphbit on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
CiphBit is a ransomware-as-a-service group active since April 2023, targeting small-to-mid-sized businesses across the UK, Europe, and North America with 38 known victims, employing a data-broker model with selective free leaks to pressure victims alongside standard double extortion.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Affiliate | February 10, 2026 | ransomware_live | reported in press coverage |
| Become Affiliate | February 10, 2026 | ransomware_live | — |
| Clínica Villa Zaita | December 2, 2025 | ransomware_live | — |
| Church of the Ascension Anglican | November 26, 2025 | ransomware_live | — |
| Jimfor, S.A. | October 28, 2025 | ransomware_live | — |
| Corneilhan | October 20, 2025 | ransomware_live | — |
| Peppermint Properties | October 20, 2025 | ransomware_live | — |
| Bader Gruppe | September 29, 2025 | ransomware_live | — |
| Kitevuc - Equipamentos E Veiculo | September 24, 2025 | ransomware_live | — |
| António Belém & António Gonçalve | September 24, 2025 | ransomware_live | — |
| iptelecom GmbH | May 27, 2025 | ransomware_live | — |
| Therma Seal Insulation Systems | February 12, 2025 | ransomware_live | — |
| Kitevuc - Equipamentos E Veiculos Utilitários E Comerciais | January 1, 2025 | ransomware_live | — |
| António Belém & António Gonçalves | December 13, 2024 | ransomware_live | — |
| AXEON 360 | November 13, 2024 | ransomware_live | — |
| CopySmart LLC | October 4, 2024 | ransomware_live | — |
| Southern Fire Sprinkler | September 28, 2024 | ransomware_live | — |
| Luigi Convertini | August 21, 2024 | ransomware_live | — |
| Keios Development Consulting | August 16, 2024 | ransomware_live | — |
| FD S.R.L | August 15, 2024 | ransomware_live | — |
| TrueNet Communications Corp | April 17, 2024 | ransomware_live | — |
| Macuz | April 9, 2024 | ransomware_live | — |
| TermoPlastic S.R.L | April 6, 2024 | ransomware_live | — |
| Commerce Dental Group | April 5, 2024 | ransomware_live | — |
| Pot O’ Gold Coffee | February 25, 2024 | ransomware_live | — |
| MPM Medical Supply | January 2, 2024 | ransomware_live | — |
| NeoDomos | November 8, 2023 | ransomware_live | — |
| APERS | November 3, 2023 | ransomware_live | — |
| Marston Domsel | September 16, 2023 | ransomware_live | — |
| TransTerra | September 16, 2023 | ransomware_live | — |
| Soprovise | September 14, 2023 | ransomware_live | — |
| RSV Centrale Bvba | September 14, 2023 | ransomware_live | — |
| Shelly Engineering Metal Work | September 14, 2023 | ransomware_live | — |
| Waterford Retirement Residence | September 14, 2023 | ransomware_live | — |
| Imperador S.R.L | September 14, 2023 | ransomware_live | — |
| Harmonic Accounting | September 14, 2023 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).