Helix
Also known as: UNC7761, helixFirst seen August 7, 2026Active17 claimed victims
The claims below are reproduced as posted by Helix on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Hypertherm | October 21, 2026 | ransomware_live | — |
| Westrock Coffee | October 21, 2026 | ransomware_live | — |
| American Campus | October 19, 2026 | ransomware_live | — |
| Quikrete | October 18, 2026 | ransomware_live | — |
| Southwire | October 18, 2026 | ransomware_live | — |
| Rheem Global | October 17, 2026 | ransomware_live | — |
| Smith Douglas Homes | October 17, 2026 | ransomware_live | — |
| Bay Alarm | October 17, 2026 | ransomware_live | — |
| Personify Health | October 17, 2026 | ransomware_live | — |
| AmSpec | August 22, 2026 | ransomware_live | — |
| Delek US | August 19, 2026 | ransomware_live | — |
| Kennedy Jenks | August 16, 2026 | ransomware_live | — |
| Westland Insurance | August 7, 2026 | ransomware_live | — |
| Morguard | August 7, 2026 | ransomware_live | — |
| Highwoods Properties | August 7, 2026 | ransomware_live | — |
| Uber | August 7, 2026 | ransomware_live | — |
| Venture Logistics | August 7, 2026 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).