nightspire
First seen March 12, 2025Active396 claimed victims
The claims below are reproduced as posted by nightspire on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, India, Taiwan, and Japan, using aggressive double-extortion with ransom deadlines as short as two days.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| SAS CAP ESTEL HOTEL | March 13, 2026 | ransomware_live | — |
| Cannavative Group | March 13, 2026 | ransomware_live | — |
| I**M** | March 12, 2026 | ransomware_live | — |
| IASMOS | March 12, 2026 | ransomware_live | — |
| Giaroli S.A.S | March 11, 2026 | ransomware_live | — |
| T****r ****t* P**p***y ***r***e*** **f**e | March 9, 2026 | ransomware_live | — |
| C*T* M**al***g*e | March 9, 2026 | ransomware_live | — |
| Taylor County Property Appraiser's Office | March 9, 2026 | ransomware_live | — |
| CFTC Métallurgie | March 9, 2026 | ransomware_live | — |
| Taylor County Property Appraiser Office | March 9, 2026 | ransomware_live | — |
| CFTC Metallurgie | March 9, 2026 | ransomware_live | — |
| T**n*e**l S.A. C***t**c***a | March 8, 2026 | ransomware_live | — |
| Tecnoedil S.A. Constructora | March 8, 2026 | ransomware_live | — |
| B** *r*t**r* *i* **s***s of ***te** *i**o**i | March 5, 2026 | ransomware_live | — |
| Big Brothers Big Sisters | March 5, 2026 | ransomware_live | — |
| JJR Engineering & Fabrication | March 5, 2026 | ransomware_live | — |
| N*X*** ** I**r****c**** | March 4, 2026 | ransomware_live | — |
| **a****t ***el*****t Gr*up L** | March 4, 2026 | ransomware_live | — |
| Stalwart Development Group LLC | March 4, 2026 | ransomware_live | — |
| NIXVAL IT Infrastructure | March 4, 2026 | ransomware_live | — |
| IOTA HOTEL TBILISI | March 1, 2026 | ransomware_live | — |
| E-Fci | March 1, 2026 | ransomware_live | — |
| *i***q** **r**n*s * H**o* | February 26, 2026 | ransomware_live | — |
| **d* **r *e*s | February 26, 2026 | ransomware_live | — |
| Fidanque Hermanos e Hijos, S.A | February 26, 2026 | ransomware_live | — |
| MAGNETA LOGISTICS, UAB | February 24, 2026 | ransomware_live | — |
| Whipflip | February 21, 2026 | ransomware_live | — |
| [Suspended] #2036 | February 21, 2026 | ransomware_live | — |
| hicare | February 21, 2026 | ransomware_live | — |
| PriceTable | February 21, 2026 | ransomware_live | — |
| Hicare.net Inc | February 21, 2026 | ransomware_live | — |
| Bain Oil Company | February 20, 2026 | ransomware_live | — |
| Union Laitiere de la Meuse | February 18, 2026 | ransomware_live | — |
| K**I* I***I*A *A | February 18, 2026 | ransomware_live | — |
| AKOL LAW | February 18, 2026 | ransomware_live | — |
| KLEIN IBERICA SA | February 18, 2026 | ransomware_live | — |
| thallos AG | February 18, 2026 | ransomware_live | — |
| SIMETRI Inc | February 15, 2026 | ransomware_live | — |
| 11th Street Veterinary Hospital | February 15, 2026 | ransomware_live | — |
| *it**a*e *ut**ot**e Ltd | February 14, 2026 | ransomware_live | — |
| *m**i**n ***i*g & *o**e* Co | February 14, 2026 | ransomware_live | — |
| American Piping & Boiler Co | February 14, 2026 | ransomware_live | — |
| TCPN Inc | February 12, 2026 | ransomware_live | — |
| US.MAD DOG CONSTRUCTION | February 10, 2026 | ransomware_live | — |
| CPG Documentation | February 10, 2026 | ransomware_live | — |
| Z*e***d M**ti* | February 9, 2026 | ransomware_live | — |
| Regal Building Materials Ltd. | February 8, 2026 | ransomware_live | — |
| Ausgewählt Vertriebs GmbH | February 7, 2026 | ransomware_live | — |
| RS Development LLC | February 7, 2026 | ransomware_live | — |
| Fico Ferragens Indústria e Comércio Ltda | February 7, 2026 | ransomware_live | — |
| Vera, spool. s.r.o. | February 6, 2026 | ransomware_live | — |
| C**U*O Co., Ltd | February 5, 2026 | ransomware_live | — |
| Adirondack Networks | February 5, 2026 | ransomware_live | — |
| CERUMO Co., Ltd | February 5, 2026 | ransomware_live | — |
| UniTurn Kft. | February 3, 2026 | ransomware_live | — |
| OFFICINE FRATELLI AMADORI snc | February 3, 2026 | ransomware_live | — |
| *F* *a**e* G**H & Co. *G | February 2, 2026 | ransomware_live | — |
| KFZ Sauter GmbH Co. KG | February 2, 2026 | ransomware_live | — |
| MD Charts | February 2, 2026 | ransomware_live | — |
| **ls*n W**k*l*w So**ti**s | February 1, 2026 | ransomware_live | — |
| Abrahamsom Center | February 1, 2026 | ransomware_live | — |
| *e**l I*s***u*e f*r Clinical Research LLC | February 1, 2026 | ransomware_live | — |
| Wilson Workflow Solutions | February 1, 2026 | ransomware_live | — |
| Pearl Institute for Clinical Research LLC | February 1, 2026 | ransomware_live | — |
| Makimura Co., Ltd. | January 31, 2026 | ransomware_live | — |
| **ci**n* *us*i** LLC | January 31, 2026 | ransomware_live | — |
| BrandingBusiness | January 29, 2026 | ransomware_live | — |
| Master Handlers | January 29, 2026 | ransomware_live | — |
| DataBank | January 28, 2026 | ransomware_live | — |
| CMA Flooring & Design | January 28, 2026 | ransomware_live | — |
| RIECO Industries Limited | January 28, 2026 | ransomware_live | — |
| OEC Medical Systems, Inc | January 27, 2026 | ransomware_live | — |
| Abu Dhabi Indian School – Branch 1, Al Wathba | January 27, 2026 | ransomware_live | — |
| Prince & Schmidt LLP | January 26, 2026 | ransomware_live | — |
| Golden Growth Biotechnology | January 25, 2026 | ransomware_live | — |
| Lesk Engineers Limited | January 25, 2026 | ransomware_live | — |
| Aromate Industries Co., Ltd. z | January 25, 2026 | ransomware_live | — |
| BIDAIAK BANOA S.L. | January 25, 2026 | ransomware_live | — |
| KICKSTAGE | January 25, 2026 | ransomware_live | — |
| The Successful Match | January 25, 2026 | ransomware_live | — |
| Hilong Petroleum Pipe Company LLC | January 24, 2026 | ransomware_live | — |
| Gianni Botsford Architects | January 24, 2026 | ransomware_live | — |
| Supriya Aesthetic Dermatology | January 23, 2026 | ransomware_live | — |
| Service Lane eAdvisor | January 22, 2026 | ransomware_live | — |
| Serometrix LLC | January 21, 2026 | ransomware_live | — |
| S.Y.L Pastilhas e Sapatas de Freios | January 21, 2026 | ransomware_live | — |
| TriApex US Laboratories | January 20, 2026 | ransomware_live | — |
| *e**a*c, F**t**i, *il**o | January 17, 2026 | ransomware_live | — |
| PERLITE, S.L.U | January 16, 2026 | ransomware_live | — |
| A.T.I di Zuinisi srl | January 15, 2026 | ransomware_live | — |
| AUTOCARES CARRETERO | January 14, 2026 | ransomware_live | — |
| A** L** Office | January 13, 2026 | ransomware_live | — |
| HO** RIL** LLP | January 6, 2026 | ransomware_live | — |
| International Door, Inc | December 16, 2025 | ransomware_live | — |
| Hyatt Place New York / Chelsea Hotel | December 14, 2025 | ransomware_live | — |
| THT Bio-Science, France | December 9, 2025 | ransomware_live | — |
| Red Star Studio Ltd | December 7, 2025 | ransomware_live | — |
| Midkiff, Muncie & Ross, P.C | December 7, 2025 | ransomware_live | — |
| Ermat Grup | December 6, 2025 | ransomware_live | — |
| The Center of Association Management | December 5, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).