BreachCensus

nightspire

First seen March 12, 2025Active396 claimed victims

The claims below are reproduced as posted by nightspire on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.

Listed organisation? Contact [email protected].

Profile

NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, India, Taiwan, and Japan, using aggressive double-extortion with ransom deadlines as short as two days.

Description from ransomware.live.

Claimed victims (as posted by the group — unverified)

Victim (as posted)Claimed onSourcePress coverage
Ri***** Co**** Europe S.r.l.June 16, 2026ransomware_live—
Central Texas ***** *****June 16, 2026ransomware_live—
Auto Royal CompanyJune 15, 2026ransomware_live—
G**** R****l*eJune 13, 2026ransomware_live—
Grupo RiquelmeJune 13, 2026ransomware_live—
A*** G*** A*S*June 7, 2026ransomware_live—
ASIA STRATEGICJune 6, 2026ransomware_live—
B****S I******t***lJune 5, 2026ransomware_live—
Unique Litho, IncJune 3, 2026ransomware_live—
Sheraton Miramar Resort El GounaJune 2, 2026ransomware_live—
Guy E******* & F*******, P.AJune 1, 2026ransomware_live—
dean cosmetic dentistryMay 31, 2026ransomware_live—
K****** County. Mi**e**taMay 29, 2026ransomware_live—
GRIP Outreach For YouthMay 28, 2026ransomware_live—
Blue Nile Medical CenterMay 27, 2026ransomware_live—
Silsbee Police DepartmentMay 27, 2026ransomware_live—
basatamfiMay 25, 2026ransomware_live—
Si**** West J*******May 24, 2026ransomware_live—
la familia adualt day centerMay 24, 2026ransomware_live—
Sierra West JewelersMay 24, 2026ransomware_live—
First Mutual HoldingsMay 23, 2026ransomware_live—
Pat**** S.r.lMay 22, 2026ransomware_live—
Pattono S.r.lMay 22, 2026ransomware_live—
Bresme Madrid S.L.May 21, 2026ransomware_live—
Red-LineMay 20, 2026ransomware_live—
Rawaj Consumer FinanceMay 19, 2026ransomware_live—
m***o*ulMay 18, 2026ransomware_live—
C***r*o T**uc**n*May 18, 2026ransomware_live—
Qua****ProMay 18, 2026ransomware_live—
WaxWorks IncMay 17, 2026ransomware_live—
Papa John's EgyptMay 16, 2026ransomware_live—
Krum Public LibraryMay 15, 2026ransomware_live—
TAKOSAN OTOMOBILMay 14, 2026ransomware_live—
Vantage Energy LLCMay 14, 2026ransomware_live—
Ueno Fine Chemicals Industry (Thailand), Ltd.May 14, 2026ransomware_live—
Huse IncorporatedMay 8, 2026ransomware_live—
J**es **l*oApril 27, 2026ransomware_live—
P**g**s***e O*al S**g**y & I**la**ol**yApril 27, 2026ransomware_live—
Progressive Oral Surgery & ImplantologyApril 27, 2026ransomware_live—
Filter to A**** F***** Plas****April 27, 2026ransomware_live—
A**** F***** Plas****April 27, 2026ransomware_live—
The **u***y C*** o* **r**nApril 25, 2026ransomware_live—
The Country Club of DarienApril 25, 2026ransomware_live—
S***s*a A**ul***e C***sApril 17, 2026ransomware_live—
Swansea Ambulance CorpsApril 17, 2026ransomware_live—
*W* **L LLCApril 7, 2026ransomware_live—
Sa**** A** ProductsApril 6, 2026ransomware_live—
Sahara Air ProductsApril 6, 2026ransomware_live—
C***n** **tu*e *n S**ur*** P**ot**hn**u*April 5, 2026ransomware_live—
Cabinet d’Étude en Sécurité PyrotechniqueApril 5, 2026ransomware_live—
D-Troy LogisticsApril 5, 2026ransomware_live—
S***a V**a***sApril 3, 2026ransomware_live—
BK TomorrowApril 2, 2026ransomware_live—
A****ia**on O*A**AApril 1, 2026ransomware_live—
Association OCACIAApril 1, 2026ransomware_live—
Carmelo Candy IncApril 1, 2026ransomware_live—
P**S****EMarch 31, 2026ransomware_live—
PARS AR-GEMarch 31, 2026ransomware_live—
T*** DefenseMarch 30, 2026ransomware_live—
TTAF DefenseMarch 30, 2026ransomware_live—
D**o*s** Fr**e* *AMarch 29, 2026ransomware_live—
*ep***e M***a*i***, Inc.March 29, 2026ransomware_live—
S**n* *o**tr***io*March 29, 2026ransomware_live—
The GMP GroupMarch 29, 2026ransomware_live—
The GMP Group ( Premier Singapore Recruitment Firm with Global Reach )March 29, 2026ransomware_live—
Neptune Mechanical, Inc.March 29, 2026ransomware_live—
Siena ConstructionMarch 29, 2026ransomware_live—
Dubosson Frères SAMarch 29, 2026ransomware_live—
*H* G** **O**March 28, 2026ransomware_live—
*h**i **o**e**March 28, 2026ransomware_live—
S***h***t*** **n**r***e of **v***h-**y A***n***tsMarch 28, 2026ransomware_live—
Ghazi BrothersMarch 28, 2026ransomware_live—
Southeastern Conference of Seventh-day AdventistsMarch 28, 2026ransomware_live—
J***T*P, **CMarch 25, 2026ransomware_live—
JT-ATFP, LLCMarch 25, 2026ransomware_live—
**l**a* & ***c** **n*n**** I**e*t**** *L*March 23, 2026ransomware_live—
Beltran & Garcia Financial Investment SLUMarch 23, 2026ransomware_live—
*o**e-*a** du ***n*c****March 22, 2026ransomware_live—
*n**g** T***a**ut*** **cMarch 22, 2026ransomware_live—
Anbogen Therapeutics Inc.March 22, 2026ransomware_live—
Notre-Dame du GrandchampMarch 22, 2026ransomware_live—
O**e*March 21, 2026ransomware_live—
**o**d* *h**a*y ***v***sMarch 21, 2026ransomware_live—
Eastex Environmental LaboratoryMarch 21, 2026ransomware_live—
Florida Therapy ServicesMarch 21, 2026ransomware_live—
OTNetMarch 21, 2026ransomware_live—
**V**C** *E**C** ***EM**I**March 20, 2026ransomware_live—
A*v**c** *e**c** ***em**i**March 20, 2026ransomware_live—
*d**n*** V**i*l* **s**b***sMarch 20, 2026ransomware_live—
Advanced Vehicle AssembliesMarch 20, 2026ransomware_live—
*L* **i**n*-**n**** GmbHMarch 19, 2026ransomware_live—
HLF Heizung-Sanitär GmbHMarch 19, 2026ransomware_live—
**ste* **vi**n***t** **b**a****March 17, 2026ransomware_live—
S*m**y* **ru**l* ***s**t**g **gi****r*March 16, 2026ransomware_live—
G* *r**n*eMarch 16, 2026ransomware_live—
Semenya Furumele Consulting EngineersMarch 16, 2026ransomware_live—
**n*a**t** **o*pMarch 13, 2026ransomware_live—
S** *A* ***E* **T*LMarch 13, 2026ransomware_live—
G* *r**c*March 13, 2026ransomware_live—
GD FranceMarch 13, 2026ransomware_live—
← NewerPage 2 of 4Older →

Claim data from ransomware.live and RansomLook (CC BY 4.0).