nightspire
First seen March 12, 2025Active396 claimed victims
The claims below are reproduced as posted by nightspire on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, India, Taiwan, and Japan, using aggressive double-extortion with ransom deadlines as short as two days.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| U**IN* Group | October 18, 2026 | ransomlook | — |
| S*o**n* Public Schools | October 15, 2026 | ransomlook | — |
| ***o* **s**e** Solutions | October 14, 2026 | ransomlook | — |
| Colorado Texas | October 14, 2026 | ransomlook | — |
| Spo****** Public Schools | October 12, 2026 | ransomlook | — |
| G** Re******* Ltd | October 12, 2026 | ransomlook | — |
| Cognosis Limited | October 12, 2026 | ransomlook | — |
| KP Industries | October 12, 2026 | ransomlook | — |
| MGT Lojistik AŞ | October 12, 2026 | ransomlook | — |
| PMG Project Management Group | October 9, 2026 | ransomlook | — |
| The Bernard Osher Foundation | October 9, 2026 | ransomlook | — |
| Fondy Food Pantry | October 9, 2026 | ransomlook | — |
| Mäntelhaus Kaiser GmbH & Co. KG | October 9, 2026 | ransomlook | — |
| Vietnam SuperPort | October 9, 2026 | ransomlook | — |
| Sangre de Cristo Arts and Conference Center | October 9, 2026 | ransomlook | — |
| Heidi's Events & Catering, Inc. | October 9, 2026 | ransomlook | — |
| WAGA Enterprises Architects LLC | October 9, 2026 | ransomlook | — |
| Medcom Tech Information | October 9, 2026 | ransomlook | — |
| INAPI | October 9, 2026 | ransomlook | — |
| KC Pharmaceuticals, Inc | October 9, 2026 | ransomlook | — |
| Valvorobica Industirale S.p.A | October 9, 2026 | ransomlook | — |
| Nantou Shiuhkuang Senior High School. | October 8, 2026 | ransomlook | — |
| KSL Dirtworks | October 8, 2026 | ransomlook | — |
| Deese and Locklear Chiropractic Center | October 8, 2026 | ransomlook | — |
| Royal EGT | October 8, 2026 | ransomlook | — |
| Lumabuilt | October 8, 2026 | ransomlook | — |
| INI Fiocruz | October 8, 2026 | ransomlook | — |
| Sinae Phuket Luxury Hotel | October 8, 2026 | ransomlook | — |
| Sociedad Portuaria Mardique S.A. | October 8, 2026 | ransomlook | — |
| Asociación de Escribanos del Uruguay | October 8, 2026 | ransomlook | — |
| G** Re******* Ltd | October 5, 2026 | ransomware_live | — |
| R***e Pa****** | October 5, 2026 | ransomlook | — |
| The Bernard Osher Foundation | October 4, 2026 | ransomware_live | — |
| Fondy Food Pantry | October 4, 2026 | ransomware_live | — |
| Colorado Texas | October 3, 2026 | ransomware_live | — |
| Forma Therapeutics Holdings, Inc. | October 3, 2026 | ransomlook | — |
| C*ro *nty *es | October 1, 2026 | ransomlook | — |
| R***e Pa****** | September 28, 2026 | ransomware_live | — |
| Forma Therapeutics Holdings, Inc. | September 21, 2026 | ransomware_live | — |
| Spo**** Schools | September 21, 2026 | ransomlook | — |
| 360 Consulenza S.r.l. | September 21, 2026 | ransomlook | — |
| Great Bay Bio | September 20, 2026 | ransomlook | — |
| S*o**n* Public Schools | September 14, 2026 | ransomware_live | — |
| Spo****** Public Schools | September 14, 2026 | ransomware_live | — |
| 360 Consulenza S.r.l. | September 14, 2026 | ransomware_live | — |
| Ozel & Ozel Laws Office | September 12, 2026 | ransomlook | — |
| Perimetral Oriental de Bogotá S.A.S. | September 12, 2026 | ransomlook | — |
| DiamondLease | September 12, 2026 | ransomlook | — |
| Tuboaços da Amazônia Ltda. | September 11, 2026 | ransomlook | — |
| Ozel & Ozel Laws Office | September 2, 2026 | ransomware_live | — |
| Transportes Montejo S.A.S. | September 1, 2026 | ransomlook | — |
| Truckworx | August 31, 2026 | ransomlook | — |
| Easyoga | August 31, 2026 | ransomlook | — |
| Perimetral Oriental de Bogotá S.A.S. | August 30, 2026 | ransomware_live | — |
| DiamondLease | August 30, 2026 | ransomware_live | — |
| Tuboaços da Amazônia Ltda. | August 11, 2026 | ransomware_live | — |
| Easyoga | August 10, 2026 | ransomware_live | — |
| eas**** | August 10, 2026 | ransomware_live | — |
| Truckworx | August 6, 2026 | ransomware_live | — |
| T****w**x | August 6, 2026 | ransomware_live | — |
| T***w**x | August 5, 2026 | ransomware_live | — |
| Tianji Auto Care Service Company | August 5, 2026 | ransomware_live | — |
| Kates Nussman Ellis Earle & Landolfi LLP | July 26, 2026 | ransomware_live | — |
| Diffusion de Produits Inoxydables | July 24, 2026 | ransomware_live | — |
| KP Industries | July 23, 2026 | ransomware_live | — |
| MGT Lojistik AŞ | July 22, 2026 | ransomware_live | — |
| Akribis Systems Pte Ltd | July 22, 2026 | ransomware_live | — |
| Mäntelhaus Kaiser GmbH & Co. KG | July 21, 2026 | ransomware_live | — |
| Vietnam SuperPort | July 20, 2026 | ransomware_live | — |
| Sangre de Cristo Arts and Conference Center | July 20, 2026 | ransomware_live | — |
| TFG Benefits, Inc. | July 20, 2026 | ransomware_live | — |
| Heidi's Events & Catering, Inc. | July 19, 2026 | ransomware_live | — |
| The Mountain | July 19, 2026 | ransomware_live | — |
| WAGA Enterprises Architects LLC | July 16, 2026 | ransomware_live | — |
| Medcom Tech Information | July 15, 2026 | ransomware_live | — |
| Vi***** Pe****** C***, Inc | July 15, 2026 | ransomware_live | — |
| Victory Personal Care, Inc | July 15, 2026 | ransomware_live | — |
| KC Pharmaceuticals, Inc | July 14, 2026 | ransomware_live | — |
| KSL Dirtworks | July 13, 2026 | ransomware_live | — |
| Valvorobica Industirale S.p.A | July 13, 2026 | ransomware_live | — |
| INAPI | July 13, 2026 | ransomware_live | — |
| Cedar Crest College | July 13, 2026 | ransomware_live | — |
| Deese and Locklear Chiropractic Center | July 12, 2026 | ransomware_live | — |
| Royal EGT | July 12, 2026 | ransomware_live | — |
| KSL Dirtworks LLC | July 10, 2026 | ransomware_live | — |
| Lumabuilt | July 8, 2026 | ransomware_live | — |
| INI Fiocruz | July 7, 2026 | ransomware_live | — |
| Sinae Phuket Luxury Hotel | July 6, 2026 | ransomware_live | — |
| PCCC Realty LLC | July 6, 2026 | ransomware_live | — |
| Webosphere | July 6, 2026 | ransomware_live | — |
| Wings Argo Private Limited | July 5, 2026 | ransomware_live | — |
| Sociedad Portuaria Mardique S.A. | July 3, 2026 | ransomware_live | — |
| Asociación de Escribanos del Uruguay | July 3, 2026 | ransomware_live | — |
| K. Venkatesh, Co | July 3, 2026 | ransomware_live | — |
| Furama Bukit Bintang | June 27, 2026 | ransomware_live | — |
| OPTIDEA GmbH | June 24, 2026 | ransomware_live | — |
| MKS Transformator | June 20, 2026 | ransomware_live | — |
| Artistic Smiles | June 19, 2026 | ransomware_live | reported in press coverage |
| legendsmn(Blue Ox, Paul Bunyan, Lumberjack Electric) | June 17, 2026 | ransomware_live | — |
| Thai Seng International Co. Ltd | June 17, 2026 | ransomware_live | — |
Page 1 of 4Older →
Claim data from ransomware.live and RansomLook (CC BY 4.0).