embargo
First seen April 21, 2024Active41 claimed victims
The claims below are reproduced as posted by embargo on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Embargo is a Rust-based ransomware-as-a-service group that emerged in April 2024, primarily targeting US healthcare, manufacturing, and business services organizations using double extortion, assessed as a potential successor to BlackCat/ALPHV with over $34 million in ransom proceeds.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| gardensalive.com, bitsandpieces.com, iselinursery.local, weeksroses.org, esm.local | September 10, 2026 | ransomlook | — |
| www.maytrucking.com | June 30, 2026 | ransomware_live | — |
| Auburn Electrical Construction Company | June 3, 2026 | ransomware_live | — |
| https://www.lagoonpark.com/ | March 31, 2026 | ransomware_live | — |
| ludlums.com | March 26, 2026 | ransomware_live | — |
| westport.com | March 14, 2026 | ransomware_live | — |
| ubm.hu | March 11, 2026 | ransomware_live | — |
| seclore.com | March 11, 2026 | ransomware_live | — |
| nch.com | March 9, 2026 | ransomware_live | — |
| lso.com | December 6, 2025 | ransomware_live | — |
| ACTi.com | October 20, 2025 | ransomware_live | — |
| usadebusk.com | September 11, 2025 | ransomware_live | — |
| Heart of America Medical Centr (HAMC) | July 17, 2025 | ransomware_live | — |
| rotaryeng.com.sg | June 10, 2025 | ransomware_live | — |
| hawaiiunified.com | June 2, 2025 | ransomware_live | — |
| allstarflooring.com | May 24, 2025 | ransomware_live | — |
| M&H Electric Fabricators | May 23, 2025 | ransomware_live | — |
| Kingsmen Creatives Ltd. | May 2, 2025 | ransomware_live | — |
| rixos.com | March 12, 2025 | ransomware_live | — |
| Insider Technologies Limited | February 27, 2025 | ransomware_live | — |
| tequaly.com | February 20, 2025 | ransomware_live | — |
| Heritage South Credit Union | February 14, 2025 | ransomware_live | — |
| myhscu.com | February 14, 2025 | ransomware_live | — |
| annegrady.org | February 5, 2025 | ransomware_live | — |
| alansarioman.com | January 9, 2025 | ransomware_live | — |
| backyarddiscovery.com | November 29, 2024 | ransomware_live | — |
| American Associated Pharmacies | November 12, 2024 | ransomware_live | — |
| wexfordcounty.org | November 5, 2024 | ransomware_live | — |
| Memorial Hospital & Manor | November 4, 2024 | ransomware_live | — |
| mh-m.org | November 4, 2024 | ransomware_live | — |
| weisermemorialhospital.org | September 4, 2024 | ransomware_live | — |
| summervillepolice.com | July 26, 2024 | ransomware_live | — |
| pioneerworldwide.com | July 26, 2024 | ransomware_live | — |
| diligentusa.com | July 11, 2024 | ransomware_live | — |
| gerard-perrier.com | July 4, 2024 | ransomware_live | — |
| dmedelivers.com | June 6, 2024 | ransomware_live | — |
| shamrocktradingcorp.com | May 21, 2024 | ransomware_live | — |
| orga-soft.de | May 17, 2024 | ransomware_live | — |
| rexmoore.com | May 8, 2024 | ransomware_live | — |
| firstmac.com.au | April 30, 2024 | ransomware_live | — |
| mulfordconstruction.com | April 17, 2024 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).