lapsus$
First seen March 1, 2026Active25 claimed victims
The claims below are reproduced as posted by lapsus$ on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Lapsus$ is an internationally composed data extortion group most active from mid-2021 through 2022, executing high-profile breaches against Microsoft, Nvidia, Samsung, Okta, and Uber by stealing source code and threatening leaks rather than encrypting files; several members — predominantly teenagers — were arrested in the UK.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| AYA BANK | June 23, 2026 | ransomware_live | — |
| GITHUB INTERNAL | June 13, 2026 | ransomware_live | — |
| INGKA GROUP | June 13, 2026 | ransomware_live | — |
| VODAFONE | May 28, 2026 | ransomware_live | — |
| AXCERA TRADING | May 10, 2026 | ransomware_live | — |
| MAPFRE ASSURANCE | April 26, 2026 | ransomware_live | — |
| CHECKMARX | April 24, 2026 | ransomware_live | — |
| MERCOR | March 31, 2026 | ransomware_live | — |
| VirtaHealth | March 29, 2026 | ransomware_live | — |
| ASTRAZENECA CORP | March 25, 2026 | ransomware_live | — |
| AXCERA.IO | March 22, 2026 | ransomware_live | — |
| Eni Energy | March 1, 2026 | ransomware_live | — |
| FR Ministry of Agriculture | March 1, 2026 | ransomware_live | — |
| Lille University | March 1, 2026 | ransomware_live | — |
| DreamUp | March 1, 2026 | ransomware_live | — |
| Lacoste | March 1, 2026 | ransomware_live | — |
| Loozap | March 1, 2026 | ransomware_live | — |
| Adidas | March 1, 2026 | ransomware_live | — |
| Salesfloor | March 1, 2026 | ransomware_live | — |
| OSAC Aero | March 1, 2026 | ransomware_live | — |
| Eiffage | March 1, 2026 | ransomware_live | — |
| Samsung Electronics | March 7, 2022 | ransomware_live | — |
| Nvidia | February 25, 2022 | ransomware_live | — |
| Impresa | January 1, 2022 | ransomware_live | — |
| Brazilian Ministry of Health | December 10, 2021 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).