metaencryptor
First seen August 16, 2023Active72 claimed victims
The claims below are reproduced as posted by metaencryptor on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
MetaEncryptor is a ransomware group first observed in mid-2023, targeting medium-to-large enterprises in legal, technology, logistics, manufacturing, and finance sectors primarily in the UK, Europe, and Southeast Asia, using AES-256/RSA-2048 encryption and double extortion.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Hologic, Inc. | October 23, 2026 | ransomlook | — |
| VIATechnik | October 12, 2026 | ransomlook | — |
| MyMichigan Health | October 12, 2026 | ransomlook | — |
| BRUKER CORPORATION | September 26, 2026 | ransomlook | — |
| Hudson MD Group, LLC | September 26, 2026 | ransomlook | — |
| Flex Ltd | September 26, 2026 | ransomlook | — |
| HyVision System. Inc | September 26, 2026 | ransomlook | — |
| Visual Intelligence, Inc. | September 26, 2026 | ransomlook | — |
| AECOM | September 26, 2026 | ransomlook | — |
| Nippon Steel Corporation | September 26, 2026 | ransomlook | — |
| EllisDon Corporation | September 26, 2026 | ransomlook | — |
| Beckman Coulter, Inc | September 26, 2026 | ransomlook | — |
| Astemo, Ltd. | September 26, 2026 | ransomlook | — |
| Aquamar Inc | September 26, 2026 | ransomlook | — |
| FactoryFive | September 26, 2026 | ransomlook | — |
| Corona Corporation | September 26, 2026 | ransomlook | — |
| Platinum Healthcare Staffing | September 25, 2026 | ransomware_live | — |
| PKF Hadiwinata | September 25, 2026 | ransomware_live | — |
| GE Vernova Inc. | September 25, 2026 | ransomware_live | — |
| Visual Intelligence, Inc. | September 21, 2026 | ransomware_live | — |
| HyVision System. Inc | September 21, 2026 | ransomware_live | — |
| Flex Ltd | September 21, 2026 | ransomware_live | — |
| Bruker Corporation | September 21, 2026 | ransomware_live | — |
| Hudson MD Group, LLC | September 21, 2026 | ransomware_live | — |
| Astemo, Ltd. | September 21, 2026 | ransomware_live | — |
| Promantra, Inc | September 17, 2026 | ransomware_live | — |
| AECOM | September 17, 2026 | ransomware_live | — |
| Beckman Coulter, Inc | September 17, 2026 | ransomware_live | — |
| Nippon Steel Corporation | September 15, 2026 | ransomware_live | — |
| SFA Engineering Corporation | September 15, 2026 | ransomware_live | — |
| Hologic, Inc. | September 7, 2026 | ransomware_live | — |
| ST Engineering | September 7, 2026 | ransomware_live | — |
| SIFCO Industries INC. | September 7, 2026 | ransomware_live | — |
| EllisDon Corporation | September 7, 2026 | ransomware_live | — |
| FactoryFive | August 23, 2026 | ransomware_live | — |
| Corona Corporation | August 23, 2026 | ransomware_live | — |
| Aquamar Inc | August 23, 2026 | ransomware_live | — |
| MPA Pharma GmbH | August 23, 2026 | ransomware_live | — |
| Weber Water Resources | August 23, 2026 | ransomware_live | — |
| Trailer Transit Inc | August 23, 2026 | ransomware_live | — |
| Woodlore International Inc. | August 23, 2026 | ransomware_live | — |
| The Lowell Hotel New York | June 24, 2025 | ransomware_live | — |
| Groupe Devimco | June 4, 2025 | ransomware_live | — |
| Third Avenue Management | April 8, 2025 | ransomware_live | — |
| Lee Hartman & Sons | January 27, 2025 | ransomware_live | — |
| Saeilo | August 23, 2024 | ransomware_live | — |
| Life University | August 22, 2024 | ransomware_live | — |
| MBS Radio | August 15, 2024 | ransomware_live | — |
| Carlex Glass Luxembourg S.A. | July 31, 2024 | ransomware_live | — |
| MBE CPA | June 14, 2024 | ransomware_live | — |
| Max Wild GmbH | May 7, 2024 | ransomware_live | — |
| Vega Reederei GmbH & Co. KG | May 7, 2024 | ransomware_live | — |
| Jetson Specialty Marketing Services, Inc. | May 7, 2024 | ransomware_live | — |
| Elbers GmbH & Co. KG | May 7, 2024 | ransomware_live | — |
| Autohaus Ebert | May 7, 2024 | ransomware_live | — |
| Garda | December 7, 2023 | ransomware_live | — |
| stormtech | December 7, 2023 | ransomware_live | — |
| JD Sprinter Holdings 2010 SL | November 28, 2023 | ransomware_live | — |
| TANATEX Chemicals | November 1, 2023 | ransomware_live | — |
| Belzona UK Ltd | September 29, 2023 | ransomware_live | — |
| Münchner Verlagsgruppe GmbH | August 16, 2023 | ransomware_live | — |
| Schwälbchen Molkerei AG | August 16, 2023 | ransomware_live | — |
| Heilmann Gruppe | August 16, 2023 | ransomware_live | — |
| ICON Creative Studio | August 16, 2023 | ransomware_live | — |
| CVO Antwerpen | August 16, 2023 | ransomware_live | — |
| Autohaus Ebert GmbH | August 16, 2023 | ransomware_live | — |
| Kraiburg Austria GmbH | August 16, 2023 | ransomware_live | — |
| Seoul Semiconductor | August 16, 2023 | ransomware_live | — |
| BOB Automotive Group | August 16, 2023 | ransomware_live | — |
| Coswell | August 16, 2023 | ransomware_live | — |
| Epicure | August 16, 2023 | ransomware_live | — |
| Dillon Supply | August 16, 2023 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).