darkvault
First seen April 11, 2024Active55 claimed victims
The claims below are reproduced as posted by darkvault on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
DarkVault is a data-exfiltration and double-extortion group first identified in late 2023, targeting medium-to-large organizations in finance, professional services, legal, and technology sectors across Europe, the UK, and North America, with a suspected connection to LockBit.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| yoniot.cn | January 6, 2025 | ransomware_live | — |
| confluxhr.com | January 2, 2025 | ransomware_live | — |
| timely.mn | December 28, 2024 | ransomware_live | — |
| salesgig.com | December 2, 2024 | ransomware_live | — |
| inthinking.net | November 20, 2024 | ransomware_live | — |
| techguard.in | November 19, 2024 | ransomware_live | — |
| arabot.io | November 19, 2024 | ransomware_live | — |
| naj.ae | November 7, 2024 | ransomware_live | — |
| freshairefranchise.com | August 28, 2024 | ransomware_live | — |
| pocketrisk.com | August 26, 2024 | ransomware_live | — |
| ingotbrokers.com | August 24, 2024 | ransomware_live | — |
| peoplewell.com | August 17, 2024 | ransomware_live | — |
| megatravel.com.mx | August 15, 2024 | ransomware_live | — |
| glazkov.co.il | August 13, 2024 | ransomware_live | — |
| gpf.org.za | August 13, 2024 | ransomware_live | — |
| lenmed.co.za | August 13, 2024 | ransomware_live | — |
| mercadomineiro.com.br | August 8, 2024 | ransomware_live | — |
| comoferta.com | August 8, 2024 | ransomware_live | — |
| warrendale-wagyu.co.uk | August 1, 2024 | ransomware_live | — |
| blankstyle.com | July 26, 2024 | ransomware_live | — |
| eurovilla.hr | July 23, 2024 | ransomware_live | — |
| foremedia.net | July 3, 2024 | ransomware_live | — |
| sequelglobal.com | July 3, 2024 | ransomware_live | — |
| pandacare.ae | June 29, 2024 | ransomware_live | — |
| life.vet.br | June 29, 2024 | ransomware_live | — |
| buyeazzy.com | June 27, 2024 | ransomware_live | — |
| decreditos.com | June 25, 2024 | ransomware_live | — |
| oexpress.id | June 21, 2024 | ransomware_live | — |
| journohq.com | June 17, 2024 | ransomware_live | — |
| cosimti.com | June 17, 2024 | ransomware_live | — |
| ZeepLive | June 12, 2024 | ransomware_live | — |
| wave2.co.kr | June 10, 2024 | ransomware_live | — |
| nordspace.lt | June 10, 2024 | ransomware_live | — |
| aletech.com.br | May 7, 2024 | ransomware_live | — |
| eskarabajo.mx | May 6, 2024 | ransomware_live | — |
| ikfhomefinance.com | May 4, 2024 | ransomware_live | — |
| sandipuniversity.edu.in | April 26, 2024 | ransomware_live | — |
| atriline.by | April 25, 2024 | ransomware_live | — |
| bzrastreador.com.br | April 24, 2024 | ransomware_live | — |
| bigtoe.yoga | April 15, 2024 | ransomware_live | — |
| qint.com.br | April 14, 2024 | ransomware_live | — |
| tommyclub.co.uk | April 12, 2024 | ransomware_live | — |
| baheya.com | April 11, 2024 | ransomware_live | — |
| baheyabeauty.com | April 11, 2024 | ransomware_live | — |
| wexer.com | April 8, 2024 | ransomware_live | — |
| thsp.co.uk | April 4, 2024 | ransomware_live | — |
| agribazaar.com | March 20, 2024 | ransomware_live | — |
| adachikan.com | March 18, 2024 | ransomware_live | — |
| lankacom.net | March 14, 2024 | ransomware_live | — |
| taskhound.com | March 14, 2024 | ransomware_live | — |
| zanebenefits.com | March 4, 2024 | ransomware_live | — |
| ezeldsolutions.com | February 21, 2024 | ransomware_live | — |
| hirebus.com | February 21, 2024 | ransomware_live | — |
| hawkremote.com | February 8, 2024 | ransomware_live | — |
| hawkremote2.com | February 8, 2024 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).