kairos
First seen November 13, 2024Active107 claimed victims
The claims below are reproduced as posted by kairos on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Kairos is a data extortion group active since late 2024 that focuses solely on data theft with no encryption, primarily targeting small-to-mid-sized organizations in healthcare, manufacturing, and business services in the US, purchasing initial access from brokers and demanding Bitcoin payments.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Oceania Digital Communications | October 14, 2026 | ransomlook | — |
| Slate Valley Unified School District | October 1, 2026 | ransomlook | — |
| Le Centre National de l'Expertise Hospitalière (CNEH) | September 30, 2026 | ransomlook | — |
| Unique Repair Services | September 29, 2026 | ransomlook | — |
| Krapf Group | September 22, 2026 | ransomlook | — |
| Leisure Coast Kitchens | September 16, 2026 | ransomlook | — |
| Ville de Libercourt | September 2, 2026 | ransomlook | — |
| Ayuntamiento de Velilla de San Antonio | August 20, 2026 | ransomware_live | — |
| Ayuntamiento de Velilla de San Antonio | August 12, 2026 | ransomware_live | — |
| Hightech Signs | August 12, 2026 | ransomware_live | — |
| Warwick Fabrics | July 30, 2026 | ransomware_live | — |
| Thermalex Inc | July 25, 2026 | ransomware_live | — |
| LR Reed | July 22, 2026 | ransomware_live | — |
| Hightech Signs | July 20, 2026 | ransomware_live | — |
| College O'Sullivan de Québec | July 20, 2026 | ransomware_live | — |
| College O'Sullivan de Québec | July 15, 2026 | ransomware_live | — |
| Warwick Fabrics | July 14, 2026 | ransomware_live | — |
| Thermalex Inc | July 13, 2026 | ransomware_live | — |
| Commune De Camiers | May 29, 2026 | ransomware_live | — |
| McCarthy Inc | May 15, 2026 | ransomware_live | — |
| Ayuntamiento de Valdemoro | May 11, 2026 | ransomware_live | — |
| Arwini | May 11, 2026 | ransomware_live | — |
| Houk Air Conditioning | May 6, 2026 | ransomware_live | — |
| Ayuntamiento de Valdemoro | May 4, 2026 | ransomware_live | — |
| Gregory Jewellers | April 22, 2026 | ransomware_live | — |
| Nordenta (a daughter company of LIFCO) | April 20, 2026 | ransomware_live | — |
| Strata Republic | April 17, 2026 | ransomware_live | — |
| FriendlyCare Pharmacy | April 15, 2026 | ransomware_live | — |
| Colonial Presbyterian Church | April 13, 2026 | ransomware_live | — |
| Pullen Moving | April 13, 2026 | ransomware_live | — |
| South Florida Injury Centers | April 7, 2026 | ransomware_live | — |
| Resch Maschinenbau | March 21, 2026 | ransomware_live | — |
| Folet & Rivoire | March 16, 2026 | ransomware_live | — |
| Institute of Social Security - Paraguay | March 10, 2026 | ransomware_live | — |
| Katz Kantor Stonestreet & Buckner | March 3, 2026 | ransomware_live | — |
| Rockwood Retirement Communities | February 26, 2026 | ransomware_live | — |
| The Marena Group | February 13, 2026 | ransomware_live | — |
| Seagrass Boutique Hospitality Group | February 12, 2026 | ransomware_live | — |
| Robbins Parking Service Ltd | February 3, 2026 | ransomware_live | — |
| Hazel Mercantile | November 24, 2025 | ransomware_live | — |
| ocbar.org/USA/114GB | October 20, 2025 | ransomware_live | — |
| OCBAR | October 20, 2025 | ransomware_live | — |
| www.ms-security-ltd.com/Cyprus/1.48TB | October 10, 2025 | ransomware_live | — |
| www.nurturecare.com/USA/192GB | October 6, 2025 | ransomware_live | — |
| Nurturecare | October 6, 2025 | ransomware_live | — |
| wilsenergy.com/USA/77.1GB | October 2, 2025 | ransomware_live | — |
| Wilsenergy | October 2, 2025 | ransomware_live | — |
| www.milkagro.sk/Slovakia/335GB | September 23, 2025 | ransomware_live | — |
| Milkagro | September 23, 2025 | ransomware_live | — |
| heidelberggc.com.au/Australia/26.4GB | September 18, 2025 | ransomware_live | — |
| Heidelberggc | September 18, 2025 | ransomware_live | — |
| ekonomipoolen.se/Sweden/32/GB | September 16, 2025 | ransomware_live | — |
| thepropertybusiness.com/Australia/164GB | September 16, 2025 | ransomware_live | — |
| Ekonomipoolen | September 16, 2025 | ransomware_live | — |
| The Property Business | September 16, 2025 | ransomware_live | — |
| summitcollege.edu/USA/370GB | August 28, 2025 | ransomware_live | — |
| Summitcollege | August 28, 2025 | ransomware_live | — |
| trico176.org/USA/180GB | August 25, 2025 | ransomware_live | — |
| melland.bright-futures.co.uk | August 5, 2025 | ransomware_live | — |
| Melland High | August 5, 2025 | ransomware_live | — |
| mortensenlawoffices.com/USA/99GB | July 28, 2025 | ransomware_live | — |
| Mortensenlawoffices | July 28, 2025 | ransomware_live | — |
| Bouey & Black LLP | July 25, 2025 | ransomware_live | — |
| inspiredbeauty.com | July 14, 2025 | ransomware_live | — |
| oandg.com.au | June 30, 2025 | ransomware_live | — |
| mcparlane.com | June 26, 2025 | ransomware_live | — |
| stopzbugs.com/USA/146GB | June 23, 2025 | ransomware_live | — |
| taoscounty.org | June 19, 2025 | ransomware_live | — |
| evanspharmacy.com/USA/56gb/ | June 17, 2025 | ransomware_live | — |
| jerichofd.com/USA/157GB/ | June 2, 2025 | ransomware_live | — |
| ndsohio.org | May 21, 2025 | ransomware_live | — |
| durhamarts.org | May 20, 2025 | ransomware_live | — |
| loopergoodwine.com | May 12, 2025 | ransomware_live | — |
| thederbyhighschool.co.uk | April 24, 2025 | ransomware_live | — |
| coloradopulmonary.com | April 23, 2025 | ransomware_live | — |
| d-line-it.com | April 16, 2025 | ransomware_live | — |
| RFMS, Inc. | April 8, 2025 | ransomware_live | — |
| galesburg.org | April 7, 2025 | ransomware_live | — |
| stattorney.org | March 31, 2025 | ransomware_live | — |
| fredsalvuccicorp.com | March 10, 2025 | ransomware_live | — |
| usarice.com | March 3, 2025 | ransomware_live | — |
| drvitenas.com | March 3, 2025 | ransomware_live | — |
| thefireplacewarehouse.co.uk | February 24, 2025 | ransomware_live | — |
| toitoiusa.com | February 17, 2025 | ransomware_live | — |
| danecourt.kent.sch.uk | February 17, 2025 | ransomware_live | — |
| medicalreportsltd.com | February 4, 2025 | ransomware_live | — |
| casperstruck.com | February 4, 2025 | ransomware_live | — |
| delpackaging.com | January 29, 2025 | ransomware_live | — |
| theurswickschool.co.uk | January 20, 2025 | ransomware_live | — |
| realtaxcanada.com | January 17, 2025 | ransomware_live | — |
| nightingalehammerson.org | January 17, 2025 | ransomware_live | — |
| jgele.com | January 15, 2025 | ransomware_live | — |
| combinedpoolandspa.com | January 15, 2025 | ransomware_live | — |
| austinsfs.com.au | December 20, 2024 | ransomware_live | — |
| eisenhowerlaw.com | December 16, 2024 | ransomware_live | — |
| archlou.org | December 13, 2024 | ransomware_live | — |
| tcpm.com | December 13, 2024 | ransomware_live | — |
| aneticaid.com | December 13, 2024 | ransomware_live | — |
| T&M Equipment | December 6, 2024 | ransomware_live | — |
| brownpacking.com | November 29, 2024 | ransomware_live | — |
Page 1 of 2Older →
Claim data from ransomware.live and RansomLook (CC BY 4.0).