nightspire
First seen March 12, 2025Active324 claimed victims
The claims below are reproduced as posted by nightspire on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, India, Taiwan, and Japan, using aggressive double-extortion with ransom deadlines as short as two days.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Abu Dhabi Indian School – Branch 1, Al Wathba | January 27, 2026 | ransomware_live | — |
| Prince & Schmidt LLP | January 26, 2026 | ransomware_live | — |
| Golden Growth Biotechnology | January 25, 2026 | ransomware_live | — |
| Lesk Engineers Limited | January 25, 2026 | ransomware_live | — |
| Aromate Industries Co., Ltd. z | January 25, 2026 | ransomware_live | — |
| BIDAIAK BANOA S.L. | January 25, 2026 | ransomware_live | — |
| KICKSTAGE | January 25, 2026 | ransomware_live | — |
| The Successful Match | January 25, 2026 | ransomware_live | — |
| Hilong Petroleum Pipe Company LLC | January 24, 2026 | ransomware_live | — |
| Gianni Botsford Architects | January 24, 2026 | ransomware_live | — |
| Supriya Aesthetic Dermatology | January 23, 2026 | ransomware_live | — |
| Service Lane eAdvisor | January 22, 2026 | ransomware_live | — |
| Serometrix LLC | January 21, 2026 | ransomware_live | — |
| S.Y.L Pastilhas e Sapatas de Freios | January 21, 2026 | ransomware_live | — |
| TriApex US Laboratories | January 20, 2026 | ransomware_live | — |
| *e**a*c, F**t**i, *il**o | January 17, 2026 | ransomware_live | — |
| PERLITE, S.L.U | January 16, 2026 | ransomware_live | — |
| A.T.I di Zuinisi srl | January 15, 2026 | ransomware_live | — |
| AUTOCARES CARRETERO | January 14, 2026 | ransomware_live | — |
| A** L** Office | January 13, 2026 | ransomware_live | — |
| HO** RIL** LLP | January 6, 2026 | ransomware_live | — |
| International Door, Inc | December 16, 2025 | ransomware_live | — |
| Hyatt Place New York / Chelsea Hotel | December 14, 2025 | ransomware_live | — |
| THT Bio-Science, France | December 9, 2025 | ransomware_live | — |
| Red Star Studio Ltd | December 7, 2025 | ransomware_live | — |
| Midkiff, Muncie & Ross, P.C | December 7, 2025 | ransomware_live | — |
| Ermat Grup | December 6, 2025 | ransomware_live | — |
| The Center of Association Management | December 5, 2025 | ransomware_live | — |
| Davis Kitchens, United States | November 25, 2025 | ransomware_live | — |
| Pioneer Ocean Freight Co., Ltd. | November 24, 2025 | ransomware_live | — |
| LAMAICA, Egypt | November 17, 2025 | ransomware_live | — |
| Balkrishna Paper Mills LTD, India | November 15, 2025 | ransomware_live | — |
| Lotus Powergear Pvt. Ltd, India | November 12, 2025 | ransomware_live | — |
| Vascara, Vietnam | November 11, 2025 | ransomware_live | — |
| NONC, India | November 11, 2025 | ransomware_live | — |
| Instituto Nacional de Oftalmologia, Peru | November 9, 2025 | ransomware_live | — |
| Eastern Cape Department of Human Settlements, South Africa | November 9, 2025 | ransomware_live | — |
| Fidelity Pension Managers, Nigeria | November 9, 2025 | ransomware_live | — |
| Servicios del Valle del Fuerte, Mexico | November 9, 2025 | ransomware_live | — |
| Brihta | November 6, 2025 | ransomware_live | — |
| vratatech | November 6, 2025 | ransomware_live | — |
| speedmais | November 6, 2025 | ransomware_live | — |
| Enem Nostrum Remedies Pvt. Ltd | November 5, 2025 | ransomware_live | — |
| BR Group | October 30, 2025 | ransomware_live | — |
| Dayal Metal Containers Factory LLC | October 30, 2025 | ransomware_live | — |
| We R Family Foundation | October 29, 2025 | ransomware_live | — |
| romar industrial company limited | October 26, 2025 | ransomware_live | — |
| Bestlog Logistic Solutions | October 26, 2025 | ransomware_live | — |
| KONCISE COMPANY LIMITED | October 22, 2025 | ransomware_live | — |
| Sangeetha Mobiles | September 18, 2025 | ransomware_live | — |
| NSC PLUS CO, LTD | September 18, 2025 | ransomware_live | — |
| conasa infraestrutura s.a. | July 6, 2025 | ransomware_live | — |
| Tuna Processors Phillipines, Inc | July 6, 2025 | ransomware_live | — |
| Twaweza | July 4, 2025 | ransomware_live | — |
| Eversendai | July 1, 2025 | ransomware_live | — |
| Premier 1888 Ltd. | June 26, 2025 | ransomware_live | — |
| JIEI CO., LTD | June 24, 2025 | ransomware_live | — |
| Comelesa | June 18, 2025 | ransomware_live | — |
| ALFA Testing Equipment | June 16, 2025 | ransomware_live | — |
| Kinik Gross Toptan Market | June 16, 2025 | ransomware_live | — |
| Petroquim Chile | June 9, 2025 | ransomware_live | — |
| Al Tadawi Specialty Hospital | June 8, 2025 | ransomware_live | — |
| QuadMiners | June 2, 2025 | ransomware_live | — |
| The Green Flame Gas Co. | June 1, 2025 | ransomware_live | — |
| Ingonyama Trust Board | June 1, 2025 | ransomware_live | — |
| Pistolero | May 30, 2025 | ransomware_live | — |
| Datatrykk | May 29, 2025 | ransomware_live | — |
| Lars Myhre Ostfold AS | May 29, 2025 | ransomware_live | — |
| Hospital José Agurto Tello de Chosica | May 28, 2025 | ransomware_live | — |
| Calcadawines | May 23, 2025 | ransomware_live | — |
| Tan Logistics in Turkey | May 23, 2025 | ransomware_live | — |
| Simalga | May 22, 2025 | ransomware_live | — |
| Ecoinside | May 21, 2025 | ransomware_live | — |
| TeamLease | May 21, 2025 | ransomware_live | — |
| Siena Hotel | May 20, 2025 | ransomware_live | — |
| Valentin Hotels | May 19, 2025 | ransomware_live | — |
| branchcore | May 18, 2025 | ransomware_live | — |
| EPK | May 18, 2025 | ransomware_live | — |
| Ertl ELECKTRO FELDBACH | May 18, 2025 | ransomware_live | — |
| C.E.E. APTA | May 8, 2025 | ransomware_live | — |
| North Kitsap School District | May 6, 2025 | ransomware_live | — |
| Julia Evans accountants | May 4, 2025 | ransomware_live | — |
| Future Association for Microfinance | April 30, 2025 | ransomware_live | — |
| csspv | April 27, 2025 | ransomware_live | — |
| Sisnet, Costa Rica | April 25, 2025 | ransomware_live | — |
| w8textil | April 25, 2025 | ransomware_live | — |
| Melco Capital Pte. Ltd. | April 23, 2025 | ransomware_live | — |
| MFR CULTIVONS LES REUSSITES, France | April 21, 2025 | ransomware_live | — |
| M-POWER Information, Taiwan | April 18, 2025 | ransomware_live | — |
| Accueil - Site Offciel de la commune d'Ardon | April 15, 2025 | ransomware_live | — |
| Wilmington Personal Injury Lawyer - DPLAW | April 14, 2025 | ransomware_live | — |
| ChangShen Hospital, Taiwan | April 13, 2025 | ransomware_live | — |
| promenade-village-dental, Canada | April 13, 2025 | ransomware_live | — |
| Compliance Consulting Group | April 11, 2025 | ransomware_live | — |
| REFFINDO-PT Pupk Indonesia | April 10, 2025 | ransomware_live | — |
| Zaphira Uniformes | April 8, 2025 | ransomware_live | — |
| Emotrans Chile | April 8, 2025 | ransomware_live | — |
| Nicera | April 6, 2025 | ransomware_live | — |
| Sistel Connections | April 4, 2025 | ransomware_live | — |
| Mid-America POOL RENOVATION, Inc | April 4, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).