m3rx
First seen April 29, 2026Active45 claimed victims
The claims below are reproduced as posted by m3rx on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
M3rx is a small ransomware group first observed in 2025, using AES-CTR/AES-GCM encryption and targeting organizations in England, the US, Australia, Germany, Italy, and Switzerland, with around eight claimed victims including a Sydney-based property firm.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| intense.pl | September 29, 2026 | ransomlook | — |
| iccsi.com | September 29, 2026 | ransomlook | — |
| noonsugar.com | September 29, 2026 | ransomlook | — |
| somasolucoes.com | September 29, 2026 | ransomlook | — |
| oterolaw.com | September 29, 2026 | ransomlook | — |
| cpacb.com | September 29, 2026 | ransomlook | — |
| cipher.systems | September 26, 2026 | ransomlook | — |
| lindner-group.com | August 29, 2026 | ransomlook | — |
| tecnoabi.com | August 14, 2026 | ransomware_live | — |
| servicebypremier.com | July 26, 2026 | ransomware_live | — |
| createinfor.pt | July 26, 2026 | ransomware_live | — |
| hydraulic-components.net | July 26, 2026 | ransomware_live | — |
| ausproof.com.au | July 24, 2026 | ransomware_live | — |
| ubfreight.com | July 22, 2026 | ransomware_live | — |
| arambol.co.uk | July 17, 2026 | ransomware_live | — |
| suppcentersa.com | July 17, 2026 | ransomware_live | — |
| wrtworld.com | July 12, 2026 | ransomware_live | — |
| foreconinc.com | July 12, 2026 | ransomware_live | — |
| eclective.ie | July 12, 2026 | ransomware_live | — |
| ktwhs.com | June 11, 2026 | ransomware_live | — |
| fasadeconsult.no | June 11, 2026 | ransomware_live | — |
| werkstoff-service.de | June 11, 2026 | ransomware_live | — |
| hbexperts-conseils.ca | June 11, 2026 | ransomware_live | — |
| suppcenter.global / suppcentersa.com | June 11, 2026 | ransomware_live | — |
| maringoodman.com | June 11, 2026 | ransomware_live | — |
| jichasa.com | May 27, 2026 | ransomware_live | — |
| grupo55.com | May 17, 2026 | ransomware_live | — |
| psbsementi.it | May 17, 2026 | ransomware_live | — |
| soft-inc.com | May 17, 2026 | ransomware_live | — |
| dosocho.es | May 17, 2026 | ransomware_live | — |
| alge-stop.dk | May 6, 2026 | ransomware_live | — |
| kbtoys.com.au | May 6, 2026 | ransomware_live | — |
| datasavior.com | May 6, 2026 | ransomware_live | — |
| pvdd.ca | May 6, 2026 | ransomware_live | — |
| manateeair.com | May 3, 2026 | ransomware_live | — |
| it-freitag.de | May 3, 2026 | ransomware_live | — |
| emtco.com | May 3, 2026 | ransomware_live | — |
| boxtopia.co.uk | April 29, 2026 | ransomware_live | — |
| osoftec.com | April 29, 2026 | ransomware_live | — |
| rotak.it | April 29, 2026 | ransomware_live | — |
| rainforestclean.com | April 29, 2026 | ransomware_live | — |
| airdriephysio.com | April 29, 2026 | ransomware_live | — |
| primeproperties.com.au | April 29, 2026 | ransomware_live | — |
| anvilarts.org.uk | April 29, 2026 | ransomware_live | — |
| dmschweiz.ch | April 29, 2026 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).