genesis
First seen October 21, 2025Active122 claimed victims
The claims below are reproduced as posted by genesis on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Genesis is an emerging ransomware group first observed in late 2025, targeting small to mid-sized US organizations across healthcare, retail, financial services, legal, and manufacturing using double-extortion tactics, focusing heavily on data exfiltration and public leaking.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Owens Distributors | October 1, 2026 | ransomlook | — |
| Vera Science | October 1, 2026 | ransomlook | — |
| TLC Perinatal | October 1, 2026 | ransomlook | — |
| VPNE | October 1, 2026 | ransomlook | — |
| VPNE | September 24, 2026 | ransomware_live | — |
| Dorfman Abrams Music, P.C | September 15, 2026 | ransomlook | — |
| Bernath & Rosenberg | September 15, 2026 | ransomlook | — |
| S******* | August 24, 2026 | ransomware_live | — |
| Hospitality Health ER (Longview) | August 20, 2026 | ransomware_live | — |
| **E*** | August 11, 2026 | ransomware_live | — |
| Interim HealthCare (Oklahoma and Tulsa) | August 10, 2026 | ransomware_live | — |
| Consolidated Medical Practices of Memphis | August 10, 2026 | ransomware_live | — |
| Interim HealthCare | August 10, 2026 | ransomware_live | — |
| C.A. Walker Construction | July 30, 2026 | ransomware_live | — |
| Boyum IT Solutions (HOT!) | July 30, 2026 | ransomware_live | — |
| **** | July 30, 2026 | ransomware_live | — |
| Infinity Pipeline,Inc. | July 26, 2026 | ransomware_live | — |
| Servonix Technologies | July 26, 2026 | ransomware_live | — |
| Westlake Realty Group, Inc. | July 26, 2026 | ransomware_live | — |
| Building Envelope Systems | July 26, 2026 | ransomware_live | — |
| JJP Slip Forming Inc. | July 26, 2026 | ransomware_live | — |
| Williams Accounting Professional | July 26, 2026 | ransomware_live | — |
| East Texas Family Medicine | July 3, 2026 | ransomware_live | — |
| Synergy Interactive | July 3, 2026 | ransomware_live | — |
| Dunagan Associates | July 3, 2026 | ransomware_live | — |
| Westgate | July 3, 2026 | ransomware_live | — |
| DICON | July 3, 2026 | ransomware_live | — |
| SBI Software | July 3, 2026 | ransomware_live | — |
| Bri-Tech, Inc | July 3, 2026 | ransomware_live | — |
| Mirage Endoscopy Center | July 3, 2026 | ransomware_live | — |
| Apex Agro, LLC | July 3, 2026 | ransomware_live | — |
| Brooklyn Defender Services | June 23, 2026 | ransomware_live | — |
| The Associated Builders and Contractors of Indiana/Kentucky | June 16, 2026 | ransomware_live | — |
| United Personnel (a division of Masis Staffing Solutions) | June 16, 2026 | ransomware_live | — |
| *B* | June 5, 2026 | ransomware_live | — |
| Family Medical Associates of Raleigh | June 3, 2026 | ransomware_live | — |
| PB White & Co | June 3, 2026 | ransomware_live | — |
| A Roettgers | May 30, 2026 | ransomware_live | — |
| Cedar Street Capital (A part of a Cynvestors Limited Partnership) | May 30, 2026 | ransomware_live | — |
| Green Resource | May 30, 2026 | ransomware_live | — |
| Wentworth | May 30, 2026 | ransomware_live | — |
| Cavalier Flooring Systems Inc. | May 30, 2026 | ransomware_live | — |
| ******** & Co | May 29, 2026 | ransomware_live | — |
| *M** | May 29, 2026 | ransomware_live | — |
| Peña & Bromberg | May 28, 2026 | ransomware_live | — |
| **** & ******** | May 21, 2026 | ransomware_live | — |
| Pequod Associates | May 11, 2026 | ransomware_live | — |
| HostBooks (HOT!) | May 9, 2026 | ransomware_live | — |
| Palo | May 9, 2026 | ransomware_live | — |
| Ben F. Barcus and associates pllc | May 9, 2026 | ransomware_live | — |
| Rain Makers Solutions | May 8, 2026 | ransomware_live | — |
| Van Atta Engineering | May 8, 2026 | ransomware_live | — |
| Prescott & Holden | May 8, 2026 | ransomware_live | — |
| The American Board of Preventive Medicine | May 8, 2026 | ransomware_live | — |
| CarePoint Health | May 8, 2026 | ransomware_live | — |
| Integrated Process Engineers & Constructors. | May 8, 2026 | ransomware_live | — |
| Fargo Moorhead West Fargo Chamber | May 8, 2026 | ransomware_live | — |
| Casino Gaming Commission | May 8, 2026 | ransomware_live | — |
| K2 Electric, Inc | April 21, 2026 | ransomware_live | — |
| Secure Health | March 31, 2026 | ransomware_live | — |
| MC-Rx | March 31, 2026 | ransomware_live | — |
| HMI Elements | March 31, 2026 | ransomware_live | — |
| Green Giftz | March 31, 2026 | ransomware_live | — |
| Raphael Ortho | March 31, 2026 | ransomware_live | — |
| B&R Sheet Metal | March 31, 2026 | ransomware_live | — |
| Catalyst Learning Company | March 31, 2026 | ransomware_live | — |
| *** | March 31, 2026 | ransomware_live | — |
| ***** ***** & ****** | March 17, 2026 | ransomware_live | — |
| Sierra Management Group | March 7, 2026 | ransomware_live | — |
| OneSource Medical Group | March 7, 2026 | ransomware_live | — |
| Sanders Legal Group | March 7, 2026 | ransomware_live | — |
| Cornerstone Financial Advisors, INC | March 7, 2026 | ransomware_live | — |
| Brighton Eye | March 7, 2026 | ransomware_live | — |
| City of Hart | March 7, 2026 | ransomware_live | — |
| NADAP | March 6, 2026 | ransomware_live | — |
| Griswold Controls | March 6, 2026 | ransomware_live | — |
| Miller Johnson Jones Antonisse & White | February 17, 2026 | ransomware_live | — |
| OfficeWorks | February 17, 2026 | ransomware_live | — |
| Fong Ilagan, LLP | February 17, 2026 | ransomware_live | — |
| Robeck Fluid Power | February 17, 2026 | ransomware_live | — |
| Community Management Associates | February 17, 2026 | ransomware_live | — |
| Stockton Cardiology Medical Group | February 17, 2026 | ransomware_live | — |
| Modern Advanced Print Solutions (MAPS, Inc.) | February 16, 2026 | ransomware_live | — |
| CHASI (A part of Sun River Health) | February 13, 2026 | ransomware_live | — |
| Community Health Action of Staten Island (A part of Sun River Health) | February 13, 2026 | ransomware_live | — |
| A******* | February 6, 2026 | ransomware_live | — |
| ***** | February 1, 2026 | ransomware_live | — |
| IMA Diligence Services (A Division of IMA Financial Group) | January 27, 2026 | ransomware_live | — |
| Global Parts & Maintenance | January 26, 2026 | ransomware_live | — |
| Goodmanagement | January 26, 2026 | ransomware_live | — |
| QFloors | January 18, 2026 | ransomware_live | — |
| Mid-park Ink | January 18, 2026 | ransomware_live | — |
| Thunder Mountain Harley-Davidson | January 18, 2026 | ransomware_live | — |
| Upper Township | January 15, 2026 | ransomware_live | — |
| Dedman Gray Property Consultants | January 15, 2026 | ransomware_live | — |
| *** ********* | January 14, 2026 | ransomware_live | — |
| Advanced Family Surgery Center (Covenant Health) | January 11, 2026 | ransomware_live | — |
| Novelty Technology Care Espana (Part of GRUPO NTC) | January 11, 2026 | ransomware_live | — |
| Abacus Employment Services. | December 8, 2025 | ransomware_live | — |
| Sunair Electronics and Circuitronix. | December 5, 2025 | ransomware_live | — |
Page 1 of 2Older →
Claim data from ransomware.live and RansomLook (CC BY 4.0).