J
First seen May 2, 2025Active41 claimed victims
The claims below are reproduced as posted by J on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
J is an emerging ransomware group that launched its leak site in May 2025, claiming over 41 victims by late 2025 including FAI Aviation Group (Germany), operating primarily as a leak-site-centric extortion identity with limited public technical analysis.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| ****.com.au | November 1, 2025 | ransomware_live | — |
| ikad.com.au - A 5-Month Staycation in the Defense Supply Chain | November 1, 2025 | ransomware_live | — |
| Dimensional Control Systems (3dcs.com) | October 1, 2025 | ransomware_live | — |
| multi-media systeme AG (mmsag.de) | September 30, 2025 | ransomware_live | — |
| Virtual Projects (virtualprojects.build) | September 29, 2025 | ransomware_live | — |
| raimore.com | September 29, 2025 | ransomware_live | — |
| J. E. Stacey & Co. Ltd (jestacey.com) | September 29, 2025 | ransomware_live | — |
| Petro-Diamond (petrodiamond.com) - subsidiary of Mitsubishi Corporation | September 29, 2025 | ransomware_live | — |
| AZpro Group (azprogroup.com) | September 29, 2025 | ransomware_live | — |
| FAI Aviation Group (fai.ag) - The biggest leak ever | September 23, 2025 | ransomware_live | — |
| a********p.com | August 13, 2025 | ransomware_live | — |
| ppmrecruit.com | August 5, 2025 | ransomware_live | — |
| aym.com.mx | August 5, 2025 | ransomware_live | — |
| bridgerecruit.co.uk | July 30, 2025 | ransomware_live | — |
| restiani.com | July 29, 2025 | ransomware_live | — |
| sou***********.net | July 27, 2025 | ransomware_live | — |
| southweststone.net | July 27, 2025 | ransomware_live | — |
| gimaex.com | June 26, 2025 | ransomware_live | — |
| diffazur.fr | June 17, 2025 | ransomware_live | — |
| powells.biz | June 15, 2025 | ransomware_live | — |
| cisin.com | June 11, 2025 | ransomware_live | — |
| rhodar.co.uk | June 10, 2025 | ransomware_live | — |
| fecovita.com | June 9, 2025 | ransomware_live | — |
| immobilia.hu | May 15, 2025 | ransomware_live | — |
| nokotapackers.com | May 14, 2025 | ransomware_live | — |
| daycohost.com | May 9, 2025 | ransomware_live | — |
| venezolanadepinturas.com | May 9, 2025 | ransomware_live | — |
| brdigital.net.br | May 5, 2025 | ransomware_live | — |
| ratnasagar.com | April 26, 2025 | ransomware_live | — |
| ferretornillos.com | April 25, 2025 | ransomware_live | — |
| bouygues-es.fr | April 25, 2025 | ransomware_live | — |
| psec.com.ar | March 16, 2025 | ransomware_live | — |
| mygoalseek.com | March 13, 2025 | ransomware_live | — |
| laticrete.com.cn | March 13, 2025 | ransomware_live | — |
| automobile-mueller.info | March 13, 2025 | ransomware_live | — |
| l-a.com.vn | March 3, 2025 | ransomware_live | — |
| atp.chaco.gob.ar | March 3, 2025 | ransomware_live | — |
| jean-petit.lu | March 2, 2025 | ransomware_live | — |
| rosekennedygreenway.org | February 23, 2025 | ransomware_live | — |
| ausfec1.com.au | February 22, 2025 | ransomware_live | — |
| uva.edu.br | February 17, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).