cloak
First seen August 24, 2023Active168 claimed victims
The claims below are reproduced as posted by cloak on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Cloak is a ransomware-as-a-service operation active since late 2022, primarily targeting small-to-medium enterprises in Europe — especially Germany — across manufacturing, healthcare, education, and government sectors, with expansion into North American and Asian targets by 2025.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| dac********er.de | October 18, 2026 | ransomlook | — |
| ********rta.ch | October 18, 2026 | ransomlook | — |
| ra-vogeler.de | June 18, 2026 | ransomware_live | — |
| W******S*******D | June 16, 2026 | ransomware_live | — |
| d**********e | June 16, 2026 | ransomware_live | — |
| ra-*******e | June 16, 2026 | ransomware_live | — |
| ****el-p*****.de | February 24, 2026 | ransomware_live | — |
| suffolkva.us | February 24, 2026 | ransomware_live | — |
| Dinnebiergruppe.de | February 19, 2026 | ransomware_live | — |
| ****ne*i***pe.de | February 3, 2026 | ransomware_live | — |
| Fitzpatrickhotels.com | December 30, 2025 | ransomware_live | — |
| *****l*****.us | December 19, 2025 | ransomware_live | — |
| ****patr**h**s.com | December 19, 2025 | ransomware_live | — |
| ****e-det**.de | November 18, 2025 | ransomware_live | — |
| Con*******.com | November 18, 2025 | ransomware_live | — |
| L********den.com | October 16, 2025 | ransomware_live | — |
| *****.com | October 16, 2025 | ransomware_live | — |
| TuftsMedicine | September 7, 2025 | ransomware_live | — |
| *******roup.ro | August 9, 2025 | ransomware_live | — |
| *********.bh | August 9, 2025 | ransomware_live | — |
| Go********l | August 9, 2025 | ransomware_live | — |
| Tu*******ne | August 9, 2025 | ransomware_live | — |
| Wstg-steuerberater.de | August 9, 2025 | ransomware_live | — |
| Ws*******.de | July 7, 2025 | ransomware_live | — |
| Nos********om.br | July 7, 2025 | ransomware_live | — |
| Pensions.gov.lk | June 27, 2025 | ransomware_live | — |
| Productionsaw.com | June 6, 2025 | ransomware_live | — |
| **********li.com | May 6, 2025 | ransomware_live | — |
| Pc***********.org | April 18, 2025 | ransomware_live | — |
| pea**********.uk | April 18, 2025 | ransomware_live | — |
| Orl***********.com | April 18, 2025 | ransomware_live | — |
| Pe*************.lk | April 18, 2025 | ransomware_live | — |
| Bosshard-farben.ch | April 18, 2025 | ransomware_live | — |
| Bosshard-Farben AG | March 28, 2025 | ransomware_live | — |
| St***********.nl | March 20, 2025 | ransomware_live | — |
| Fi***************.pa | March 20, 2025 | ransomware_live | — |
| Baltimorecityschools | March 20, 2025 | ransomware_live | — |
| Wr-recht.de | March 20, 2025 | ransomware_live | — |
| Oag.state.va.us | March 20, 2025 | ransomware_live | — |
| ba**********.org | February 25, 2025 | ransomware_live | — |
| oa*************.us | February 20, 2025 | ransomware_live | — |
| pen********.de | February 20, 2025 | ransomware_live | — |
| wr********.de | February 20, 2025 | ransomware_live | — |
| op*********.eu | February 20, 2025 | ransomware_live | — |
| Waggonereng.com | February 20, 2025 | ransomware_live | — |
| Ad***********.ca | February 3, 2025 | ransomware_live | — |
| Centromedicoenova | January 30, 2025 | ransomware_live | — |
| Premierautocredit.com | January 29, 2025 | ransomware_live | — |
| Neovita.de | January 28, 2025 | ransomware_live | — |
| Kaisersbach.de | January 28, 2025 | ransomware_live | — |
| Bwfg.at | January 23, 2025 | ransomware_live | — |
| ge*******.com | January 21, 2025 | ransomware_live | — |
| Wa**********.com | January 21, 2025 | ransomware_live | — |
| pre*************.com | January 21, 2025 | ransomware_live | — |
| Town of Ponoka | December 30, 2024 | ransomware_live | — |
| bac***********.com.au | December 30, 2024 | ransomware_live | — |
| Mai***********.de | December 30, 2024 | ransomware_live | — |
| Fmp.gob.pe | December 20, 2024 | ransomware_live | — |
| Ne***********.de | December 20, 2024 | ransomware_live | — |
| Kai*************.de | December 20, 2024 | ransomware_live | — |
| Orthopaedie-hof.de | December 10, 2024 | ransomware_live | — |
| Ukh-hof.de | December 10, 2024 | ransomware_live | — |
| N************.uk | December 10, 2024 | ransomware_live | — |
| Donnewalddistributing | December 4, 2024 | ransomware_live | — |
| Uk***********.de | November 28, 2024 | ransomware_live | — |
| Bw**********.at | November 28, 2024 | ransomware_live | — |
| Ma************.de | November 28, 2024 | ransomware_live | — |
| Or*************.de | November 28, 2024 | ransomware_live | — |
| Globalresultspr.com | November 19, 2024 | ransomware_live | — |
| don****************.com | November 16, 2024 | ransomware_live | — |
| F************.pe | November 16, 2024 | ransomware_live | — |
| SCAFF'HOLDING | November 6, 2024 | ransomware_live | — |
| Glo**************.com | November 6, 2024 | ransomware_live | — |
| o******************v | November 6, 2024 | ransomware_live | — |
| mm********.com | October 22, 2024 | ransomware_live | — |
| Te***************.net | September 26, 2024 | ransomware_live | — |
| Ful************.com | September 26, 2024 | ransomware_live | — |
| Pennvet.com | September 25, 2024 | ransomware_live | — |
| Wertachkliniken.de | September 19, 2024 | ransomware_live | — |
| we****************.de | September 3, 2024 | ransomware_live | — |
| El**********.hu | September 3, 2024 | ransomware_live | — |
| Pen*****************.com | September 3, 2024 | ransomware_live | — |
| Stjamesplace.org | August 23, 2024 | ransomware_live | — |
| Westermans.com | August 21, 2024 | ransomware_live | — |
| Hvb-ingenieure.de | August 21, 2024 | ransomware_live | — |
| Vibo.dk | August 21, 2024 | ransomware_live | — |
| Dunlop Aircraft Tyres | August 21, 2024 | ransomware_live | — |
| Cb**********.com | August 14, 2024 | ransomware_live | — |
| Entr**************.fr | August 14, 2024 | ransomware_live | — |
| St**************.org | August 5, 2024 | ransomware_live | — |
| Dd*******uk | August 1, 2024 | ransomware_live | — |
| Kalaswire.com | July 27, 2024 | ransomware_live | — |
| Ka******.com | July 22, 2024 | ransomware_live | — |
| We*******.com | July 22, 2024 | ransomware_live | — |
| Hv*************.de | July 22, 2024 | ransomware_live | — |
| Vi*********.dk | July 15, 2024 | ransomware_live | — |
| upcli.com | July 15, 2024 | ransomware_live | — |
| Dun*****************uk | July 4, 2024 | ransomware_live | — |
| Abileneisd.org | July 4, 2024 | ransomware_live | — |
| Unit*****************.com | June 30, 2024 | ransomware_live | — |
Page 1 of 2Older →
Claim data from ransomware.live and RansomLook (CC BY 4.0).