doppelpaymer
First seen May 25, 2019Active25 claimed victims
The claims below are reproduced as posted by doppelpaymer on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Doppelpaymer is a ransomware family that encrypts user data and later on it asks for a ransom in order to restore original files. It is recognizable by its trademark file extension added to encrypted files: .doppeled. It also creates a note file named: ".how2decrypt.txt".
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Office of the Attorney General | April 10, 2021 | ransomware_live | — |
| Azusa police department | March 1, 2021 | ransomware_live | — |
| Manutan | February 21, 2021 | ransomware_live | — |
| Kia Motors America (KMA) | February 16, 2021 | ransomware_live | — |
| Cuyahoga Metropolitan Housing Authority | February 8, 2021 | ransomware_live | — |
| Foxconn | November 29, 2020 | ransomware_live | — |
| Delaware County | November 28, 2020 | ransomware_live | — |
| Compal | November 8, 2020 | ransomware_live | — |
| Banijay Group SAS | November 1, 2020 | ransomware_live | — |
| Chatham County Government | October 28, 2020 | ransomware_live | — |
| Hall County | October 7, 2020 | ransomware_live | — |
| Newcastle University | August 30, 2020 | ransomware_live | — |
| 4 Canadian courier divisions of TFI International's Canpar Express | August 19, 2020 | ransomware_live | — |
| Boyce Technologies (device manufacturer- transit communication systems and now ventilators b/c of COVID-19) | August 1, 2020 | ransomware_live | — |
| Knoxville PD and City of Knoxville, TN (Knox County) | June 11, 2020 | ransomware_live | — |
| City of Florence, Alabama | June 5, 2020 | ransomware_live | — |
| Digital Management Inc. (NASA Contractor) | June 3, 2020 | ransomware_live | — |
| Mitsubishi | June 1, 2020 | ransomware_live | — |
| Afpa | April 17, 2020 | ransomware_live | — |
| Kimchuk | March 5, 2020 | ransomware_live | — |
| City of Torrance (Los Angeles County) | March 1, 2020 | ransomware_live | — |
| Visser Precision | February 1, 2020 | ransomware_live | — |
| Bretagne Telecom | January 1, 2020 | ransomware_live | — |
| Chilean Ministry of Agriculture | June 1, 2019 | ransomware_live | — |
| City of Edcouch | May 25, 2019 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).