nightspire
First seen March 12, 2025Active396 claimed victims
The claims below are reproduced as posted by nightspire on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, India, Taiwan, and Japan, using aggressive double-extortion with ransom deadlines as short as two days.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Davis Kitchens, United States | November 25, 2025 | ransomware_live | — |
| Pioneer Ocean Freight Co., Ltd. | November 24, 2025 | ransomware_live | — |
| LAMAICA, Egypt | November 17, 2025 | ransomware_live | — |
| Balkrishna Paper Mills LTD, India | November 15, 2025 | ransomware_live | — |
| Lotus Powergear Pvt. Ltd, India | November 12, 2025 | ransomware_live | — |
| Vascara, Vietnam | November 11, 2025 | ransomware_live | — |
| NONC, India | November 11, 2025 | ransomware_live | — |
| Instituto Nacional de Oftalmologia, Peru | November 9, 2025 | ransomware_live | — |
| Eastern Cape Department of Human Settlements, South Africa | November 9, 2025 | ransomware_live | — |
| Fidelity Pension Managers, Nigeria | November 9, 2025 | ransomware_live | — |
| Servicios del Valle del Fuerte, Mexico | November 9, 2025 | ransomware_live | — |
| Brihta | November 6, 2025 | ransomware_live | — |
| vratatech | November 6, 2025 | ransomware_live | — |
| speedmais | November 6, 2025 | ransomware_live | — |
| Enem Nostrum Remedies Pvt. Ltd | November 5, 2025 | ransomware_live | — |
| BR Group | October 30, 2025 | ransomware_live | — |
| Dayal Metal Containers Factory LLC | October 30, 2025 | ransomware_live | — |
| We R Family Foundation | October 29, 2025 | ransomware_live | — |
| romar industrial company limited | October 26, 2025 | ransomware_live | — |
| Bestlog Logistic Solutions | October 26, 2025 | ransomware_live | — |
| KONCISE COMPANY LIMITED | October 22, 2025 | ransomware_live | — |
| Sangeetha Mobiles | September 18, 2025 | ransomware_live | — |
| NSC PLUS CO, LTD | September 18, 2025 | ransomware_live | — |
| conasa infraestrutura s.a. | July 6, 2025 | ransomware_live | — |
| Tuna Processors Phillipines, Inc | July 6, 2025 | ransomware_live | — |
| Twaweza | July 4, 2025 | ransomware_live | — |
| Eversendai | July 1, 2025 | ransomware_live | — |
| Premier 1888 Ltd. | June 26, 2025 | ransomware_live | — |
| JIEI CO., LTD | June 24, 2025 | ransomware_live | — |
| Comelesa | June 18, 2025 | ransomware_live | — |
| ALFA Testing Equipment | June 16, 2025 | ransomware_live | — |
| Kinik Gross Toptan Market | June 16, 2025 | ransomware_live | — |
| Petroquim Chile | June 9, 2025 | ransomware_live | — |
| Al Tadawi Specialty Hospital | June 8, 2025 | ransomware_live | — |
| QuadMiners | June 2, 2025 | ransomware_live | — |
| The Green Flame Gas Co. | June 1, 2025 | ransomware_live | — |
| Ingonyama Trust Board | June 1, 2025 | ransomware_live | — |
| Pistolero | May 30, 2025 | ransomware_live | — |
| Datatrykk | May 29, 2025 | ransomware_live | — |
| Lars Myhre Ostfold AS | May 29, 2025 | ransomware_live | — |
| Hospital José Agurto Tello de Chosica | May 28, 2025 | ransomware_live | — |
| Calcadawines | May 23, 2025 | ransomware_live | — |
| Tan Logistics in Turkey | May 23, 2025 | ransomware_live | — |
| Simalga | May 22, 2025 | ransomware_live | — |
| Ecoinside | May 21, 2025 | ransomware_live | — |
| TeamLease | May 21, 2025 | ransomware_live | — |
| Siena Hotel | May 20, 2025 | ransomware_live | — |
| Valentin Hotels | May 19, 2025 | ransomware_live | — |
| branchcore | May 18, 2025 | ransomware_live | — |
| EPK | May 18, 2025 | ransomware_live | — |
| Ertl ELECKTRO FELDBACH | May 18, 2025 | ransomware_live | — |
| C.E.E. APTA | May 8, 2025 | ransomware_live | — |
| North Kitsap School District | May 6, 2025 | ransomware_live | — |
| Julia Evans accountants | May 4, 2025 | ransomware_live | — |
| Future Association for Microfinance | April 30, 2025 | ransomware_live | — |
| csspv | April 27, 2025 | ransomware_live | — |
| Sisnet, Costa Rica | April 25, 2025 | ransomware_live | — |
| w8textil | April 25, 2025 | ransomware_live | — |
| Melco Capital Pte. Ltd. | April 23, 2025 | ransomware_live | — |
| MFR CULTIVONS LES REUSSITES, France | April 21, 2025 | ransomware_live | — |
| M-POWER Information, Taiwan | April 18, 2025 | ransomware_live | — |
| Accueil - Site Offciel de la commune d'Ardon | April 15, 2025 | ransomware_live | — |
| Wilmington Personal Injury Lawyer - DPLAW | April 14, 2025 | ransomware_live | — |
| ChangShen Hospital, Taiwan | April 13, 2025 | ransomware_live | — |
| promenade-village-dental, Canada | April 13, 2025 | ransomware_live | — |
| Compliance Consulting Group | April 11, 2025 | ransomware_live | — |
| REFFINDO-PT Pupk Indonesia | April 10, 2025 | ransomware_live | — |
| Zaphira Uniformes | April 8, 2025 | ransomware_live | — |
| Emotrans Chile | April 8, 2025 | ransomware_live | — |
| Nicera | April 6, 2025 | ransomware_live | — |
| Sistel Connections | April 4, 2025 | ransomware_live | — |
| Mid-America POOL RENOVATION, Inc | April 4, 2025 | ransomware_live | — |
| Audit Accounting Advisory Taxes | April 3, 2025 | ransomware_live | — |
| Secretaria de Educacion de Veracruz, SEV | April 1, 2025 | ransomware_live | — |
| InterLOGIC Inc | April 1, 2025 | ransomware_live | — |
| STORT | April 1, 2025 | ransomware_live | — |
| OMCI S.p.a | March 30, 2025 | ransomware_live | — |
| Powiatowy Urząd Pracy w Żorach | March 30, 2025 | ransomware_live | — |
| INI Investments | March 30, 2025 | ransomware_live | — |
| MISR AL MAHABA HOSPITAL | March 24, 2025 | ransomware_live | — |
| SUMITOMOTOOL | March 23, 2025 | ransomware_live | — |
| KHAZMODAN STUDIOS | March 22, 2025 | ransomware_live | — |
| 6ixty8ight | March 18, 2025 | ransomware_live | — |
| Tanaka Electronics Taiwan Co., LTD | March 18, 2025 | ransomware_live | — |
| Bridgewater Retirement Community | March 16, 2025 | ransomware_live | — |
| Sanyo Special Steel India Pvt. Ltd. | March 16, 2025 | ransomware_live | — |
| Hydro-Vacuum S.A. | March 12, 2025 | ransomware_live | — |
| Wilson Re Limited | March 12, 2025 | ransomware_live | — |
| Tanaka Electronics Taiwan Co.,LTD | March 10, 2025 | ransomware_live | — |
| Far East Consortium International Limited | March 8, 2025 | ransomware_live | — |
| Far East Consortium | March 7, 2025 | ransomware_live | — |
| Waihong Environmental Services Limited | March 5, 2025 | ransomware_live | — |
| Business Ledger Limited | March 3, 2025 | ransomware_live | — |
| Raja Ferry Port Public Company Limited | March 3, 2025 | ransomware_live | — |
| Tohpe Corporation | March 1, 2025 | ransomware_live | — |
| Baily International of Atlanta | February 17, 2025 | ransomware_live | — |
← NewerPage 4 of 4
Claim data from ransomware.live and RansomLook (CC BY 4.0).