kazu
First seen November 11, 2025Active36 claimed victims
The claims below are reproduced as posted by kazu on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Kazu is an emerging ransomware group active since September 2025 that employs double-extortion tactics, targeting government, healthcare, and financial organizations primarily in Southeast Asia, the Middle East, and Latin America, with notable claimed breaches including Dubai's Ports, Customs and Free Zone Corporation with 1.94 TB exfiltrated.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| PappyJoe: Healthcare Management System | September 7, 2026 | ransomlook | — |
| Instituto Ferrero de Neurología y Sueño | September 7, 2026 | ransomlook | — |
| Brazil Mobilemed: Cloud PACS Platform | September 7, 2026 | ransomlook | — |
| Canada Yocale: Appointment Management System | September 7, 2026 | ransomlook | — |
| PawlyClinic: Digital Veterinary Care Platform | September 7, 2026 | ransomlook | — |
| Dr Akbar Niazi Teaching Hospital | September 7, 2026 | ransomlook | — |
| Centro Médico Especializado OSI: Healthcare Solutions | September 7, 2026 | ransomlook | — |
| Meducar: Telemedicine and Patient Management System | September 7, 2026 | ransomlook | — |
| ConsultorioMovil: Telemedicine and Healthcare System | September 7, 2026 | ransomlook | — |
| Gauteng Provincial Government | September 7, 2026 | ransomlook | — |
| Natclar (S.G. Natclar S.A.C.) | September 7, 2026 | ransomlook | — |
| Health Time | September 7, 2026 | ransomlook | — |
| HealthDaq | September 7, 2026 | ransomlook | — |
| Gauteng City Region Academy (GCRA) | September 7, 2026 | ransomlook | — |
| Statistics South Africa – Official National Data and Insights Portal | September 7, 2026 | ransomlook | — |
| MSM Unify: Global Education Platform - CA | September 7, 2026 | ransomlook | — |
| Spirit Cultural Exchange - US | September 5, 2026 | ransomware_live | — |
| Redacted | August 25, 2026 | ransomware_live | — |
| ConsultorioMovil: Telemedicine and Healthcare System | August 23, 2026 | ransomware_live | — |
| Meducar: Telemedicine and Patient Management System | August 23, 2026 | ransomware_live | — |
| Centro Médico Especializado OSI: Healthcare Solutions | August 23, 2026 | ransomware_live | — |
| Dr Akbar Niazi Teaching Hospital | August 23, 2026 | ransomware_live | — |
| PawlyClinic: Digital Veterinary Care Platform | August 23, 2026 | ransomware_live | — |
| Canada Yocale: Appointment Management System | August 23, 2026 | ransomware_live | — |
| Brazil Mobilemed: Cloud PACS Platform | August 23, 2026 | ransomware_live | — |
| Instituto Ferrero de Neurología y Sueño | August 23, 2026 | ransomware_live | — |
| PappyJoe: Healthcare Management System | August 23, 2026 | ransomware_live | — |
| zHealthEHR — Practice Management Software for Chiropractic & Wellness Clinics | January 26, 2026 | ransomware_live | — |
| MyVete | January 12, 2026 | ransomware_live | — |
| Saudi Icon | December 29, 2025 | ransomware_live | — |
| ManageMyHealth - New Zealand | December 29, 2025 | ransomware_live | — |
| Leadway Assurance | December 11, 2025 | ransomware_live | — |
| CT Dent Ltd | December 6, 2025 | ransomware_live | — |
| National Civil Service Commission of Colombia | November 10, 2025 | ransomware_live | — |
| Defensoría del Pueblo de Colombia – Protection and Promotion of Human Rights | November 8, 2025 | ransomware_live | — |
| Doctor Alliance – Streamlined Document and Billing Management for Healthcare Providers | November 6, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).