moneymessage
Also known as: ThreatLabzFirst seen March 29, 2023Active36 claimed victims
The claims below are reproduced as posted by moneymessage on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Money Message emerged in March 2023 targeting Windows and Linux systems across banking, transportation, and professional services sectors, demanding ransoms in the millions and publishing stolen data on their blog if unpaid, with most known victims based in the US.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| U.S. Electrical Services and Wiedenbach Brown | September 21, 2026 | ransomware_live | — |
| ProCare | August 28, 2026 | ransomware_live | — |
| Yourway Transportation | July 25, 2026 | ransomware_live | — |
| Indigo Energy | July 23, 2026 | ransomware_live | — |
| Envision Unlimited | July 9, 2026 | ransomware_live | — |
| X-Copper Professional | July 2, 2026 | ransomware_live | — |
| Forestdale | May 11, 2026 | ransomware_live | — |
| Family Partnerships of Central Florida | January 28, 2026 | ransomware_live | — |
| Bucks County Opportunity Council, INC. | August 4, 2025 | ransomware_live | — |
| Young Adjustment Company | July 15, 2025 | ransomware_live | — |
| The Tech Interactive | April 16, 2025 | ransomware_live | — |
| Marina Family Medical | January 18, 2025 | ransomware_live | — |
| National Atomic Energy Commission | December 18, 2024 | ransomware_live | — |
| Kazyon | December 13, 2024 | ransomware_live | — |
| The Egyptian Tax Authority (ETA) | November 17, 2024 | ransomware_live | — |
| First Baptist Medical Center | June 19, 2024 | ransomware_live | — |
| Insurance Agency Marketing Services | May 16, 2024 | ransomware_live | — |
| Anna Jaques Hospital | January 19, 2024 | ransomware_live | — |
| Tri-Way Manufacturing Technologies | October 12, 2023 | ransomware_live | — |
| Maxco Supply | October 3, 2023 | ransomware_live | — |
| MD LOGISTICS | October 3, 2023 | ransomware_live | — |
| Toscana Promozione | October 3, 2023 | ransomware_live | — |
| Aiphone | September 3, 2023 | ransomware_live | — |
| Estes Design & Manufacturing | September 3, 2023 | ransomware_live | — |
| Riverside Logistics | September 3, 2023 | ransomware_live | — |
| Taylor University | September 2, 2023 | ransomware_live | — |
| Meteksan Defence Industry | July 14, 2023 | ransomware_live | — |
| Propper International | July 11, 2023 | ransomware_live | — |
| Pharmerica.com & BrightSpring Health Services | April 8, 2023 | ransomware_live | — |
| Micro Star International | April 7, 2023 | ransomware_live | — |
| Guess who! | April 5, 2023 | ransomware_live | — |
| midamericanglass.com | April 3, 2023 | ransomware_live | — |
| Goldenbear.com & mjhallandcompany.com | April 2, 2023 | ransomware_live | — |
| Biman airlines | March 23, 2023 | ransomware_live | — |
| Hawaii self storage | March 19, 2023 | ransomware_live | — |
| Lpa-group.com | January 4, 2023 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).