nightspire
First seen March 12, 2025Active324 claimed victims
The claims below are reproduced as posted by nightspire on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, India, Taiwan, and Japan, using aggressive double-extortion with ransom deadlines as short as two days.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Southeastern Conference of Seventh-day Adventists | March 28, 2026 | ransomware_live | — |
| J***T*P, **C | March 25, 2026 | ransomware_live | — |
| JT-ATFP, LLC | March 25, 2026 | ransomware_live | — |
| **l**a* & ***c** **n*n**** I**e*t**** *L* | March 23, 2026 | ransomware_live | — |
| Beltran & Garcia Financial Investment SLU | March 23, 2026 | ransomware_live | — |
| *o**e-*a** du ***n*c**** | March 22, 2026 | ransomware_live | — |
| *n**g** T***a**ut*** **c | March 22, 2026 | ransomware_live | — |
| Anbogen Therapeutics Inc. | March 22, 2026 | ransomware_live | — |
| Notre-Dame du Grandchamp | March 22, 2026 | ransomware_live | — |
| O**e* | March 21, 2026 | ransomware_live | — |
| **o**d* *h**a*y ***v***s | March 21, 2026 | ransomware_live | — |
| Eastex Environmental Laboratory | March 21, 2026 | ransomware_live | — |
| Florida Therapy Services | March 21, 2026 | ransomware_live | — |
| OTNet | March 21, 2026 | ransomware_live | — |
| **V**C** *E**C** ***EM**I** | March 20, 2026 | ransomware_live | — |
| A*v**c** *e**c** ***em**i** | March 20, 2026 | ransomware_live | — |
| *d**n*** V**i*l* **s**b***s | March 20, 2026 | ransomware_live | — |
| Advanced Vehicle Assemblies | March 20, 2026 | ransomware_live | — |
| *L* **i**n*-**n**** GmbH | March 19, 2026 | ransomware_live | — |
| HLF Heizung-Sanitär GmbH | March 19, 2026 | ransomware_live | — |
| **ste* **vi**n***t** **b**a**** | March 17, 2026 | ransomware_live | — |
| S*m**y* **ru**l* ***s**t**g **gi****r* | March 16, 2026 | ransomware_live | — |
| G* *r**n*e | March 16, 2026 | ransomware_live | — |
| Semenya Furumele Consulting Engineers | March 16, 2026 | ransomware_live | — |
| **n*a**t** **o*p | March 13, 2026 | ransomware_live | — |
| S** *A* ***E* **T*L | March 13, 2026 | ransomware_live | — |
| G* *r**c* | March 13, 2026 | ransomware_live | — |
| GD France | March 13, 2026 | ransomware_live | — |
| SAS CAP ESTEL HOTEL | March 13, 2026 | ransomware_live | — |
| Cannavative Group | March 13, 2026 | ransomware_live | — |
| I**M** | March 12, 2026 | ransomware_live | — |
| IASMOS | March 12, 2026 | ransomware_live | — |
| Giaroli S.A.S | March 11, 2026 | ransomware_live | — |
| T****r ****t* P**p***y ***r***e*** **f**e | March 9, 2026 | ransomware_live | — |
| C*T* M**al***g*e | March 9, 2026 | ransomware_live | — |
| Taylor County Property Appraiser's Office | March 9, 2026 | ransomware_live | — |
| CFTC Métallurgie | March 9, 2026 | ransomware_live | — |
| Taylor County Property Appraiser Office | March 9, 2026 | ransomware_live | — |
| CFTC Metallurgie | March 9, 2026 | ransomware_live | — |
| T**n*e**l S.A. C***t**c***a | March 8, 2026 | ransomware_live | — |
| Tecnoedil S.A. Constructora | March 8, 2026 | ransomware_live | — |
| B** *r*t**r* *i* **s***s of ***te** *i**o**i | March 5, 2026 | ransomware_live | — |
| Big Brothers Big Sisters | March 5, 2026 | ransomware_live | — |
| JJR Engineering & Fabrication | March 5, 2026 | ransomware_live | — |
| N*X*** ** I**r****c**** | March 4, 2026 | ransomware_live | — |
| **a****t ***el*****t Gr*up L** | March 4, 2026 | ransomware_live | — |
| Stalwart Development Group LLC | March 4, 2026 | ransomware_live | — |
| NIXVAL IT Infrastructure | March 4, 2026 | ransomware_live | — |
| IOTA HOTEL TBILISI | March 1, 2026 | ransomware_live | — |
| E-Fci | March 1, 2026 | ransomware_live | — |
| *i***q** **r**n*s * H**o* | February 26, 2026 | ransomware_live | — |
| **d* **r *e*s | February 26, 2026 | ransomware_live | — |
| Fidanque Hermanos e Hijos, S.A | February 26, 2026 | ransomware_live | — |
| MAGNETA LOGISTICS, UAB | February 24, 2026 | ransomware_live | — |
| Whipflip | February 21, 2026 | ransomware_live | — |
| [Suspended] #2036 | February 21, 2026 | ransomware_live | — |
| hicare | February 21, 2026 | ransomware_live | — |
| PriceTable | February 21, 2026 | ransomware_live | — |
| Hicare.net Inc | February 21, 2026 | ransomware_live | — |
| Bain Oil Company | February 20, 2026 | ransomware_live | — |
| Union Laitiere de la Meuse | February 18, 2026 | ransomware_live | — |
| K**I* I***I*A *A | February 18, 2026 | ransomware_live | — |
| AKOL LAW | February 18, 2026 | ransomware_live | — |
| KLEIN IBERICA SA | February 18, 2026 | ransomware_live | — |
| thallos AG | February 18, 2026 | ransomware_live | — |
| SIMETRI Inc | February 15, 2026 | ransomware_live | — |
| 11th Street Veterinary Hospital | February 15, 2026 | ransomware_live | — |
| *it**a*e *ut**ot**e Ltd | February 14, 2026 | ransomware_live | — |
| *m**i**n ***i*g & *o**e* Co | February 14, 2026 | ransomware_live | — |
| American Piping & Boiler Co | February 14, 2026 | ransomware_live | — |
| TCPN Inc | February 12, 2026 | ransomware_live | — |
| US.MAD DOG CONSTRUCTION | February 10, 2026 | ransomware_live | — |
| CPG Documentation | February 10, 2026 | ransomware_live | — |
| Z*e***d M**ti* | February 9, 2026 | ransomware_live | — |
| Regal Building Materials Ltd. | February 8, 2026 | ransomware_live | — |
| Ausgewählt Vertriebs GmbH | February 7, 2026 | ransomware_live | — |
| RS Development LLC | February 7, 2026 | ransomware_live | — |
| Fico Ferragens Indústria e Comércio Ltda | February 7, 2026 | ransomware_live | — |
| Vera, spool. s.r.o. | February 6, 2026 | ransomware_live | — |
| C**U*O Co., Ltd | February 5, 2026 | ransomware_live | — |
| Adirondack Networks | February 5, 2026 | ransomware_live | — |
| CERUMO Co., Ltd | February 5, 2026 | ransomware_live | — |
| UniTurn Kft. | February 3, 2026 | ransomware_live | — |
| OFFICINE FRATELLI AMADORI snc | February 3, 2026 | ransomware_live | — |
| *F* *a**e* G**H & Co. *G | February 2, 2026 | ransomware_live | — |
| KFZ Sauter GmbH Co. KG | February 2, 2026 | ransomware_live | — |
| MD Charts | February 2, 2026 | ransomware_live | — |
| **ls*n W**k*l*w So**ti**s | February 1, 2026 | ransomware_live | — |
| Abrahamsom Center | February 1, 2026 | ransomware_live | — |
| *e**l I*s***u*e f*r Clinical Research LLC | February 1, 2026 | ransomware_live | — |
| Wilson Workflow Solutions | February 1, 2026 | ransomware_live | — |
| Pearl Institute for Clinical Research LLC | February 1, 2026 | ransomware_live | — |
| Makimura Co., Ltd. | January 31, 2026 | ransomware_live | — |
| **ci**n* *us*i** LLC | January 31, 2026 | ransomware_live | — |
| BrandingBusiness | January 29, 2026 | ransomware_live | — |
| Master Handlers | January 29, 2026 | ransomware_live | — |
| DataBank | January 28, 2026 | ransomware_live | — |
| CMA Flooring & Design | January 28, 2026 | ransomware_live | — |
| RIECO Industries Limited | January 28, 2026 | ransomware_live | — |
| OEC Medical Systems, Inc | January 27, 2026 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).