hunters
First seen October 20, 2023Active307 claimed victims
The claims below are reproduced as posted by hunters on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
In mid-October 2023, just a few days before the Europol operation, the source code of the Ransomware Hive was sold, along with its website and older versions developed in Golang and C (although this purchase has only been reported by the actors without concrete evidence). The buyer of this new source code was the group Hunters International, who claimed to have fixed the bugs in the Ransomware Hive that were responsible for preventing file decryption in some cases.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Toyota Brazil | April 13, 2024 | ransomware_live | — |
| Bojangles’ International | April 12, 2024 | ransomware_live | — |
| Jordano's Inc. | April 12, 2024 | ransomware_live | — |
| Notions Marketing | April 12, 2024 | ransomware_live | — |
| Optima Manufacturing | April 11, 2024 | ransomware_live | — |
| Robertson Cheatham Farmers | April 10, 2024 | ransomware_live | — |
| Inszone Insurance Services | April 10, 2024 | ransomware_live | — |
| T A Khoury | April 9, 2024 | ransomware_live | — |
| Paulmann Licht | April 8, 2024 | ransomware_live | — |
| Intersport | April 3, 2024 | ransomware_live | — |
| Citi Trends | April 3, 2024 | ransomware_live | — |
| Benetton Group | April 3, 2024 | ransomware_live | — |
| Beaver Run Resort | April 3, 2024 | ransomware_live | — |
| DataBank | April 3, 2024 | ransomware_live | — |
| Interface | April 3, 2024 | ransomware_live | — |
| BeneCare Dental Insurance | April 3, 2024 | ransomware_live | — |
| Sysmex | March 29, 2024 | ransomware_live | — |
| Exela Technologies | March 28, 2024 | ransomware_live | — |
| CLARK Material Handling Company | March 25, 2024 | ransomware_live | — |
| Panzeri Cattaneo | March 19, 2024 | ransomware_live | — |
| Therapeutic Health Services | March 19, 2024 | ransomware_live | — |
| Sting AD | March 19, 2024 | ransomware_live | — |
| Hallesche Kraftverkehrs & Speditions GmbH | March 19, 2024 | ransomware_live | — |
| Sun Holdings | March 18, 2024 | ransomware_live | — |
| AGL | March 18, 2024 | ransomware_live | — |
| HSI | March 18, 2024 | ransomware_live | — |
| Miki Travel | March 16, 2024 | ransomware_live | — |
| Cosmocolor | March 14, 2024 | ransomware_live | — |
| Kaplan | March 12, 2024 | ransomware_live | — |
| ATL | March 12, 2024 | ransomware_live | — |
| ATL Leasing | March 12, 2024 | ransomware_live | — |
| NetVigour | March 11, 2024 | ransomware_live | — |
| ACE Air Cargo | March 9, 2024 | ransomware_live | — |
| DiVal Safety Equipment, Inc. | March 4, 2024 | ransomware_live | — |
| IJM Corporation | February 23, 2024 | ransomware_live | — |
| Finlay Screening & Crushing Systems | February 20, 2024 | ransomware_live | — |
| CP Communications | February 17, 2024 | ransomware_live | — |
| PSI | February 17, 2024 | ransomware_live | — |
| Wapiti Energy | February 17, 2024 | ransomware_live | — |
| BS&B Safety Systems L.L.C | February 17, 2024 | ransomware_live | — |
| Chicago Zoological Society | February 17, 2024 | ransomware_live | — |
| Aftrp | February 17, 2024 | ransomware_live | — |
| Voice Technologies | February 17, 2024 | ransomware_live | — |
| Tiete Automobile | February 17, 2024 | ransomware_live | — |
| Greater Napanee | February 17, 2024 | ransomware_live | — |
| ACS | February 17, 2024 | ransomware_live | — |
| Griffin Dewatering | February 16, 2024 | ransomware_live | — |
| Ribe-Groupe | February 16, 2024 | ransomware_live | — |
| Concello de Teo | February 16, 2024 | ransomware_live | — |
| Réseau Ribé | February 16, 2024 | ransomware_live | — |
| Schuster Trucking Company | February 15, 2024 | ransomware_live | — |
| Satse | February 13, 2024 | ransomware_live | — |
| Communication Federal Credit Union | February 13, 2024 | ransomware_live | — |
| Sindicato de Enfermería (SATSE) | February 13, 2024 | ransomware_live | — |
| Kreyenhop & Kluge | February 12, 2024 | ransomware_live | — |
| Avianor Aircraft | February 10, 2024 | ransomware_live | — |
| Carespring Health Care | February 10, 2024 | ransomware_live | — |
| Dalmahoy Hotel & Country Club | February 10, 2024 | ransomware_live | — |
| Groupe Goyette | February 10, 2024 | ransomware_live | — |
| Impact Energy Services | February 10, 2024 | ransomware_live | — |
| SOPEM Tunisie | February 10, 2024 | ransomware_live | — |
| Benchmark Management Group | February 10, 2024 | ransomware_live | — |
| Nastech | February 10, 2024 | ransomware_live | — |
| Lancaster County Sheriff's Office | February 10, 2024 | ransomware_live | — |
| Village of Skokie | February 10, 2024 | ransomware_live | — |
| SOPEM | February 10, 2024 | ransomware_live | — |
| Ducont | February 8, 2024 | ransomware_live | — |
| Thorite Group | January 24, 2024 | ransomware_live | — |
| Tamdown | January 24, 2024 | ransomware_live | — |
| Innovative Automation | January 24, 2024 | ransomware_live | — |
| Charles Trent | January 24, 2024 | ransomware_live | — |
| R.C. Moore Trucking | January 23, 2024 | ransomware_live | — |
| Double Eagle Development | January 22, 2024 | ransomware_live | — |
| Double Eagle Energy Holdings IV | January 22, 2024 | ransomware_live | — |
| Alupar Investimento SA | January 19, 2024 | ransomware_live | — |
| Gallup McKinley County Schools | January 18, 2024 | ransomware_live | — |
| Ausa | January 15, 2024 | ransomware_live | — |
| Gunning & LaFazia, Inc. | January 4, 2024 | ransomware_live | — |
| Thermosash Commercial Ltd | January 4, 2024 | ransomware_live | — |
| Project M.O.R.E. | January 4, 2024 | ransomware_live | — |
| Bradford Health | January 3, 2024 | ransomware_live | — |
| Blackstone Valley Community Health Care | December 18, 2023 | ransomware_live | — |
| Fred Hutchinson Cancer Research Center | December 15, 2023 | ransomware_live | — |
| Azienda USL di Modena | December 11, 2023 | ransomware_live | — |
| St. Johns River Water Management District | December 1, 2023 | ransomware_live | — |
| Austal | December 1, 2023 | ransomware_live | — |
| Austal USA | December 1, 2023 | ransomware_live | — |
| Covenant Care | November 30, 2023 | ransomware_live | — |
| First Housing Development | November 28, 2023 | ransomware_live | — |
| InstantWhip | November 27, 2023 | ransomware_live | — |
| Lincoln Office | November 24, 2023 | ransomware_live | — |
| Crystal Lake Health Center | November 21, 2023 | ransomware_live | — |
| THK Co., Ltd. | November 15, 2023 | ransomware_live | — |
| TCI Co., Ltd. | November 13, 2023 | ransomware_live | — |
| Homeland Inc. | November 13, 2023 | ransomware_live | — |
| Owens Group | November 12, 2023 | ransomware_live | — |
| DrilMaco | November 12, 2023 | ransomware_live | — |
| IDESA group, S.A. De C.V. | November 12, 2023 | ransomware_live | — |
| Bartec Top Holding GmbH | November 10, 2023 | ransomware_live | — |
| Garr Silpe, P.C. | November 9, 2023 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).