clop
Also known as: Cl0pFirst seen March 13, 2020Active1,366 claimed victims
The claims below are reproduced as posted by clop on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
The ransomware group known as Cl0p is a variant of a previously known strain dubbed CryptoMix. It is worth noting that this variant was delivered as the final payload in a phishing campaign in 2019 and was exclusively financially motivated, with attacks carried out by the threat actors TA505.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| OMNITANKER.COM | August 5, 2026 | ransomware_live | — |
| ARCHERGREY.COM | August 5, 2026 | ransomware_live | — |
| G3AEROSPACE.COM | August 5, 2026 | ransomware_live | — |
| ITKHOLDING.HU | August 5, 2026 | ransomware_live | — |
| MIDLANDIND.COM.AU | August 5, 2026 | ransomware_live | — |
| FLUIDLOGIC.COM | August 5, 2026 | ransomware_live | — |
| QCPL.IN | August 5, 2026 | ransomware_live | — |
| STNET.IT | August 5, 2026 | ransomware_live | — |
| ECCELLENT.COM | August 5, 2026 | ransomware_live | — |
| IPMSOLUTIONS.SK | August 5, 2026 | ransomware_live | — |
| NUVITIA.COM | August 5, 2026 | ransomware_live | — |
| BLUEVISTALLC.COM | July 31, 2026 | ransomware_live | — |
| INTEGRALIFE.COM | May 1, 2026 | ransomware_live | — |
| INJURYLAWYERS.COM | May 1, 2026 | ransomware_live | — |
| CLOUD.CLEARWAYGROUP.COM | March 30, 2026 | ransomware_live | — |
| AIGHEALTHCARE.IN | March 30, 2026 | ransomware_live | — |
| ANSTECHINC.COM | February 14, 2026 | ransomware_live | — |
| HUDSONEXECUTIVE.COM | February 14, 2026 | ransomware_live | — |
| ITARCHITECHS.COM | February 14, 2026 | ransomware_live | — |
| PROACTIVEMEDICAL.COM | February 14, 2026 | ransomware_live | — |
| SMITHIPSERVICES.COM | February 14, 2026 | ransomware_live | — |
| BE09.FR | February 14, 2026 | ransomware_live | — |
| BROADREACHRETAIL.COM | February 14, 2026 | ransomware_live | — |
| RBDCONSTRUCTION.COM | February 14, 2026 | ransomware_live | — |
| CHEHARDY.COM | February 14, 2026 | ransomware_live | — |
| GOKALLIT.COM | February 14, 2026 | ransomware_live | — |
| HUDSONSUSTAINABLE.COM | February 14, 2026 | ransomware_live | — |
| ONESUPPORT.COM | February 14, 2026 | ransomware_live | — |
| GIASPACE.COM | February 14, 2026 | ransomware_live | — |
| GIACARE.COM | February 14, 2026 | ransomware_live | — |
| HYDEPARKUMC.ORG | February 14, 2026 | ransomware_live | — |
| AIGBUSINESS.COM | February 14, 2026 | ransomware_live | — |
| THEPERPETUAL.COM | February 14, 2026 | ransomware_live | — |
| GARNERGROUP.NET | February 14, 2026 | ransomware_live | — |
| SPOHNASSOCIATES.COM | February 14, 2026 | ransomware_live | — |
| CFDT.FR | February 14, 2026 | ransomware_live | — |
| BOYDEN.COM | February 14, 2026 | ransomware_live | — |
| SOLUTIONSINSAFETY.COM | February 14, 2026 | ransomware_live | — |
| FISHWINDOWCLEANING.COM | February 14, 2026 | ransomware_live | — |
| THEMORTGAGEFIRM.COM | February 14, 2026 | ransomware_live | — |
| DAD.CO.TH | February 14, 2026 | ransomware_live | — |
| M-B.LAW | February 7, 2026 | ransomware_live | — |
| ARKTLA.ORG | February 7, 2026 | ransomware_live | — |
| COBU-ARCH.COM | February 7, 2026 | ransomware_live | — |
| ESCALI.COM | February 7, 2026 | ransomware_live | — |
| MCKEEGROUP.NET | February 7, 2026 | ransomware_live | — |
| CENTINELA.COM.BR | February 7, 2026 | ransomware_live | — |
| GALEINTL.COM | February 7, 2026 | ransomware_live | — |
| ISLANDOUTPOST.COM | February 7, 2026 | ransomware_live | — |
| KRIEGMANANDSMITH.COM | February 7, 2026 | ransomware_live | — |
| NYASPHALT.COM | February 7, 2026 | ransomware_live | — |
| KLMEQUITIES.COM | February 7, 2026 | ransomware_live | — |
| NEXTPHAZE.COM.AU | February 7, 2026 | ransomware_live | — |
| ETTOAUSTRALIA.COM | February 7, 2026 | ransomware_live | — |
| THEHALEROAD.COM.AU | February 7, 2026 | ransomware_live | — |
| MRAGROUP.COM.AU | February 7, 2026 | ransomware_live | — |
| PODIATRYWA.COM.AU | February 7, 2026 | ransomware_live | — |
| RMWGROUP.COM.AU | February 7, 2026 | ransomware_live | — |
| VENTNOR.COM.AU | February 7, 2026 | ransomware_live | — |
| Y-ARCHITECTURE.STUDIO | February 7, 2026 | ransomware_live | — |
| ROBERTSDESIGNS.COM.AU | February 7, 2026 | ransomware_live | — |
| SKYEEXCAVATIONS.COM.AU | February 7, 2026 | ransomware_live | — |
| WHOLEIT.COM.AU | February 7, 2026 | ransomware_live | — |
| KVHELI.WORDPRESS.COM | February 7, 2026 | ransomware_live | — |
| SENSIBLESOLUTIONS.CA | February 7, 2026 | ransomware_live | — |
| CLOUDDATAWORKS.CA | February 7, 2026 | ransomware_live | — |
| SMTLAWYERS.CA | February 7, 2026 | ransomware_live | — |
| GRANITEPOINTE.CA | February 7, 2026 | ransomware_live | — |
| HTHELI.COM | February 7, 2026 | ransomware_live | — |
| COWANS.ORG | February 7, 2026 | ransomware_live | — |
| CMHHELI.COM | February 7, 2026 | ransomware_live | — |
| DESKTOPG.COM | February 7, 2026 | ransomware_live | — |
| WHEELOCKST.COM | February 7, 2026 | ransomware_live | — |
| NVHG.COM | February 7, 2026 | ransomware_live | — |
| HODERO HOLDINGS LTD | February 7, 2026 | ransomware_live | — |
| LOGICALMICRO.COM | February 7, 2026 | ransomware_live | — |
| EMEG.CO.UK | February 7, 2026 | ransomware_live | — |
| MARK-FINN.CO.UK | February 7, 2026 | ransomware_live | — |
| SERVE-CLOUD.COM | February 7, 2026 | ransomware_live | — |
| SHACKELFORD.LAW | February 7, 2026 | ransomware_live | — |
| DCSNORWAY.COM | February 7, 2026 | ransomware_live | — |
| LONGHORNORGANICS.COM | February 7, 2026 | ransomware_live | — |
| WARDHAVENCAPITAL.COM | February 7, 2026 | ransomware_live | — |
| MEDIAWORLD.COM.HK | February 7, 2026 | ransomware_live | — |
| AUGUSTEA.COM | February 7, 2026 | ransomware_live | — |
| LABINF.IT | February 7, 2026 | ransomware_live | — |
| NGATTORNEYS.COM | February 7, 2026 | ransomware_live | — |
| CONWEST.COM | February 7, 2026 | ransomware_live | — |
| DUKOSI.COM | February 7, 2026 | ransomware_live | — |
| CROWDEDISLAND.COM | February 7, 2026 | ransomware_live | — |
| IDEALWELDERS.COM | February 7, 2026 | ransomware_live | — |
| STRATEGICOBJECTIVES.COM | February 7, 2026 | ransomware_live | — |
| TRJLTD.CO.UK | February 7, 2026 | ransomware_live | — |
| VIPPLLC.COM | February 7, 2026 | ransomware_live | — |
| MNKASSOCIATES.COM | February 7, 2026 | ransomware_live | — |
| CENTAURPRODUCTS.COM | January 25, 2026 | ransomware_live | — |
| INTEGRITEK.NET | January 25, 2026 | ransomware_live | — |
| BUREAUX.FR | January 25, 2026 | ransomware_live | — |
| ONYXEQUITIES.COM | January 25, 2026 | ransomware_live | — |
| KCDWORLDWIDE.COM | January 25, 2026 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).