nightspire
First seen March 12, 2025Active324 claimed victims
The claims below are reproduced as posted by nightspire on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, India, Taiwan, and Japan, using aggressive double-extortion with ransom deadlines as short as two days.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Transportes Montejo S.A.S. | September 1, 2026 | ransomlook | — |
| Truckworx | August 31, 2026 | ransomlook | — |
| Easyoga | August 31, 2026 | ransomlook | — |
| Easyoga | August 10, 2026 | ransomware_live | — |
| eas**** | August 10, 2026 | ransomware_live | — |
| Truckworx | August 6, 2026 | ransomware_live | — |
| T****w**x | August 6, 2026 | ransomware_live | — |
| T***w**x | August 5, 2026 | ransomware_live | — |
| Tianji Auto Care Service Company | August 5, 2026 | ransomware_live | — |
| Kates Nussman Ellis Earle & Landolfi LLP | July 26, 2026 | ransomware_live | — |
| Diffusion de Produits Inoxydables | July 24, 2026 | ransomware_live | — |
| Akribis Systems Pte Ltd | July 22, 2026 | ransomware_live | — |
| TFG Benefits, Inc. | July 20, 2026 | ransomware_live | — |
| The Mountain | July 19, 2026 | ransomware_live | — |
| Vi***** Pe****** C***, Inc | July 15, 2026 | ransomware_live | — |
| Victory Personal Care, Inc | July 15, 2026 | ransomware_live | — |
| Cedar Crest College | July 13, 2026 | ransomware_live | — |
| KSL Dirtworks LLC | July 10, 2026 | ransomware_live | — |
| PCCC Realty LLC | July 6, 2026 | ransomware_live | — |
| Webosphere | July 6, 2026 | ransomware_live | — |
| Wings Argo Private Limited | July 5, 2026 | ransomware_live | — |
| K. Venkatesh, Co | July 3, 2026 | ransomware_live | — |
| Furama Bukit Bintang | June 27, 2026 | ransomware_live | — |
| OPTIDEA GmbH | June 24, 2026 | ransomware_live | — |
| MKS Transformator | June 20, 2026 | ransomware_live | — |
| Artistic Smiles | June 19, 2026 | ransomware_live | — |
| legendsmn(Blue Ox, Paul Bunyan, Lumberjack Electric) | June 17, 2026 | ransomware_live | — |
| Thai Seng International Co. Ltd | June 17, 2026 | ransomware_live | — |
| Ri***** Co**** Europe S.r.l. | June 16, 2026 | ransomware_live | — |
| Central Texas ***** ***** | June 16, 2026 | ransomware_live | — |
| Auto Royal Company | June 15, 2026 | ransomware_live | — |
| G**** R****l*e | June 13, 2026 | ransomware_live | — |
| Grupo Riquelme | June 13, 2026 | ransomware_live | — |
| A*** G*** A*S* | June 7, 2026 | ransomware_live | — |
| ASIA STRATEGIC | June 6, 2026 | ransomware_live | — |
| B****S I******t***l | June 5, 2026 | ransomware_live | — |
| Unique Litho, Inc | June 3, 2026 | ransomware_live | — |
| Sheraton Miramar Resort El Gouna | June 2, 2026 | ransomware_live | — |
| Guy E******* & F*******, P.A | June 1, 2026 | ransomware_live | — |
| dean cosmetic dentistry | May 31, 2026 | ransomware_live | — |
| K****** County. Mi**e**ta | May 29, 2026 | ransomware_live | — |
| GRIP Outreach For Youth | May 28, 2026 | ransomware_live | — |
| Blue Nile Medical Center | May 27, 2026 | ransomware_live | — |
| Silsbee Police Department | May 27, 2026 | ransomware_live | — |
| basatamfi | May 25, 2026 | ransomware_live | — |
| Si**** West J******* | May 24, 2026 | ransomware_live | — |
| la familia adualt day center | May 24, 2026 | ransomware_live | — |
| Sierra West Jewelers | May 24, 2026 | ransomware_live | — |
| First Mutual Holdings | May 23, 2026 | ransomware_live | — |
| Pat**** S.r.l | May 22, 2026 | ransomware_live | — |
| Pattono S.r.l | May 22, 2026 | ransomware_live | — |
| Bresme Madrid S.L. | May 21, 2026 | ransomware_live | — |
| Red-Line | May 20, 2026 | ransomware_live | — |
| Rawaj Consumer Finance | May 19, 2026 | ransomware_live | — |
| m***o*ul | May 18, 2026 | ransomware_live | — |
| C***r*o T**uc**n* | May 18, 2026 | ransomware_live | — |
| Qua****Pro | May 18, 2026 | ransomware_live | — |
| WaxWorks Inc | May 17, 2026 | ransomware_live | — |
| Papa John's Egypt | May 16, 2026 | ransomware_live | — |
| Krum Public Library | May 15, 2026 | ransomware_live | — |
| TAKOSAN OTOMOBIL | May 14, 2026 | ransomware_live | — |
| Vantage Energy LLC | May 14, 2026 | ransomware_live | — |
| Ueno Fine Chemicals Industry (Thailand), Ltd. | May 14, 2026 | ransomware_live | — |
| Huse Incorporated | May 8, 2026 | ransomware_live | — |
| J**es **l*o | April 27, 2026 | ransomware_live | — |
| P**g**s***e O*al S**g**y & I**la**ol**y | April 27, 2026 | ransomware_live | — |
| Progressive Oral Surgery & Implantology | April 27, 2026 | ransomware_live | — |
| Filter to A**** F***** Plas**** | April 27, 2026 | ransomware_live | — |
| A**** F***** Plas**** | April 27, 2026 | ransomware_live | — |
| The **u***y C*** o* **r**n | April 25, 2026 | ransomware_live | — |
| The Country Club of Darien | April 25, 2026 | ransomware_live | — |
| S***s*a A**ul***e C***s | April 17, 2026 | ransomware_live | — |
| Swansea Ambulance Corps | April 17, 2026 | ransomware_live | — |
| *W* **L LLC | April 7, 2026 | ransomware_live | — |
| Sa**** A** Products | April 6, 2026 | ransomware_live | — |
| Sahara Air Products | April 6, 2026 | ransomware_live | — |
| C***n** **tu*e *n S**ur*** P**ot**hn**u* | April 5, 2026 | ransomware_live | — |
| Cabinet d’Étude en Sécurité Pyrotechnique | April 5, 2026 | ransomware_live | — |
| D-Troy Logistics | April 5, 2026 | ransomware_live | — |
| S***a V**a***s | April 3, 2026 | ransomware_live | — |
| BK Tomorrow | April 2, 2026 | ransomware_live | — |
| A****ia**on O*A**A | April 1, 2026 | ransomware_live | — |
| Association OCACIA | April 1, 2026 | ransomware_live | — |
| Carmelo Candy Inc | April 1, 2026 | ransomware_live | — |
| P**S****E | March 31, 2026 | ransomware_live | — |
| PARS AR-GE | March 31, 2026 | ransomware_live | — |
| T*** Defense | March 30, 2026 | ransomware_live | — |
| TTAF Defense | March 30, 2026 | ransomware_live | — |
| D**o*s** Fr**e* *A | March 29, 2026 | ransomware_live | — |
| *ep***e M***a*i***, Inc. | March 29, 2026 | ransomware_live | — |
| S**n* *o**tr***io* | March 29, 2026 | ransomware_live | — |
| The GMP Group | March 29, 2026 | ransomware_live | — |
| The GMP Group ( Premier Singapore Recruitment Firm with Global Reach ) | March 29, 2026 | ransomware_live | — |
| Neptune Mechanical, Inc. | March 29, 2026 | ransomware_live | — |
| Siena Construction | March 29, 2026 | ransomware_live | — |
| Dubosson Frères SA | March 29, 2026 | ransomware_live | — |
| *H* G** **O** | March 28, 2026 | ransomware_live | — |
| *h**i **o**e** | March 28, 2026 | ransomware_live | — |
| S***h***t*** **n**r***e of **v***h-**y A***n***ts | March 28, 2026 | ransomware_live | — |
| Ghazi Brothers | March 28, 2026 | ransomware_live | — |
Page 1 of 4Older →
Claim data from ransomware.live and RansomLook (CC BY 4.0).